Translate

Friday, July 17, 2026

Check the last logins and unlock into MS Windows

 Get-WinEvent -ProviderName 'Microsoft-Windows-Security-Auditing' -FilterXPath "*[System[EventID=4624] and EventData[Data[@Name='LogonType']='7' or Data[@Name='LogonType']='2']]" -MaxEvents 50


LogonType = 2 -  Login into machine

LogonType = 7 - Unlock from Screen Protector password

No comments:

Blog Archive