Computer Lock Out Time Stamp Using PowerShell

  • Article

Requirement:

We need a custom log file to find machine Lock Out timestamps.

Solution:

The above will give some information.

Sample Code is below. Once you lock the computer a text file will be generated with a timestamp.

Register-ObjectEvent -InputObject ([Microsoft.Win32.SystemEvents]) -EventName "SessionSwitch" -Action 
    {
Switch($event.SourceEventArgs.Reason) 
        {
    'SessionLock'    { (Get-Date) | Out-File C:\Temp\SystemLockedReport.txt -Append }
    'SessionUnlock'  { (Get-Date)| Out-File C:\Temp\SystemUnLockedReport.txt -Append}
        }
    } | Out-Null

Screen Shot:

Output:

Enjoy PowerShell!