If you need to output a list of all local PC unlocks and logins you can use the below steps. This will only display ‘unlocks’ and ‘logins’ for a locally cached domain user.
The below will show you all 'local' (not remote) logins and unlocks:- 1. Open Event viewer 2. Navigate to Windows Logs > Security 3. Click Filter Current Log 4. Select XML Tab 5. Tick Edit Query 6. Replace the entire query with the below:- <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[(EventID='4624')] and EventData[Data[@Name='LogonType'] and (Data='7' or Data='11')] and EventData[Data[@Name='ProcessName']='C:\Windows\System32\winlogon.exe'] ] </Select> </Query> </QueryList>
You can get a list of login types from here:- https://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396