If you need to output a list of all local PC unlocks and logins you can use the below steps. This will only display ‘unlocks’ and ‘logins’ for a locally cached domain user.
The below will show you all 'local' (not remote) logins and unlocks:- 1. Open Event viewer 2. Navigate to Windows Logs > Security 3. Click Filter Current Log 4. Select XML Tab 5. Tick Edit Query 6. Replace the entire query with the below:- <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[(EventID='4624')] and EventData[Data[@Name='LogonType'] and (Data='7' or Data='11')] and EventData[Data[@Name='ProcessName']='C:\Windows\System32\winlogon.exe'] ] </Select> </Query> </QueryList>
Before I keep on going with this we have another tip to follow, learn how to use the macro recorder which allows you to record a sequence of events to create a Windows macro. The Macro Recorder will record keystrokes, mouse events and window activations, including window positions and dimensions. This makes it easy to create a macro that can be played back to run the task automatically.
Symptoms
After you restart a computer running Windows and no one has logged on, you may be unable to log on to the computer either locally or to the domain.
The following error message may be displayed at logon:
This computer is in use and has been locked.
Only or an administrator can unlock this computer.
Press Ctrl + Alt + Del to unlock this computer.
If you try to unlock the computer, the following error message may be displayed:
This computer is locked. Only or an administrator can unlock this computer.
If a user has logged on and logged off, you may be unable to log on to the computer (locally or to the domain) and the following error message may be displayed:
This computer is in use and has been locked.
Only domain\username or an administrator can unlock this computer.
Press Ctrl + Alt + Del to unlock this computer.
If you try to unlock the computer, the following error message may be displayed:
This computer is locked. Only domain\username or an administrator can unlock this computer.
NOTES
In the error messages above, domain is the domain name of the last user who logged on to the server and username is the name of the user who last logged on to the server.
Cause
This behavior can occur for either of the following reasons:
When the default screen saver is set to use a non-existent screen saver program.
When you use a corrupted screen saver that is password protected.
Resolution
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To resolve this problem, use another screen saver program (such as Logon.scr) that is installed locally on the system or that is not corrupted.
Start Registry Editor (Regedt32.exe).
Locate the Scrnsave.exe value under the following registry key:
HKEY_USERS\.Default\Control Panel\Desktop
On the Edit menu, click String, type logon.scr, and then click OK.
Locate the ScreenSaverIsSecure value.
On the Edit menu, click String, type 0, and then click OK.
Quit Registry Editor.
WORKAROUND
To work around this problem, use the appropriate method.
Method 1: When the Error Message States the Computer Is Locked by domain\username
Press CTRL+ALT+DELETE to unlock the computer.
Type the logon information for the last logged on user, and then click OK.
When the Unlock Computer dialog box disappears, press CTRL+ALT+DELETE and log on normally.
Method 2: When the Error Message Does Not State Who Locked the Computer
Use the Shutdown tool in the Microsoft Windows Resource Kit and attempt to shut down the locked computer. The System Shutdown dialog box is displayed on the locked computer, but the computer does not restart.
When the shutdown timer expires, the Welcome to Windows dialog box is displayed.
Before the screen saver becomes active, press CTRL+ALT+DELETE, and log on normally.
NOTE: If you do not use one of these methods to log on, you must restart the computer and log on before the screen saver program starts.
You can get a list of login types from here:- https://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396