Share via

Audit Lock/Unlock Windows

Amanda 0 Reputation points
2025-10-21T13:37:47.9233333+00:00

Back in September, I enabled the Audit logon, Audit logoff, and Audit other login/logoff events within the Local Group Policy Editor. I then went into Event Viewer and created a custom view including the events 4800,4801 to track when my computer is locked and unlocked. I have the filter set to view last 30 days but I am only seeing events from yesterday and today.

Why can I not see the events from when I enabled the Audit logon/logoff in Local Group Policy Editor?

Please help.

Windows for home | Other | Security and privacy
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Richard Trinidad 3,760 Reputation points Independent Advisor
    2025-10-21T19:08:48.19+00:00

    Hi Amanda, thanks for posting in the Microsoft community, even though you enabled auditing in Local Group Policy, Windows doesn't retroactively log events. It only starts logging after the policy is applied and the system is restarted, here’s what you can do.

     

    First, Confirm Audit Policy is Active, Open Command Prompt as Admin then Run: auditpol /get /category:Logon/Logoff then make sure Logon, Logoff, and Other Logon/Logoff Events show as Success or Success and Failure.

    Next, Restart Your PC, if you haven’t since enabled the policy, then Wait for New Events to be generated, only events after the restart will show up.

    Also, Check Event Viewer Again, simply Go to your custom view then make sure the date filter is correct and not too narrow.

     

    I hope this helps you out, let me know how it goes.

    Chard

     

  2. Richard Trinidad 3,760 Reputation points Independent Advisor
    2025-10-23T20:02:31.7133333+00:00

    Hi Amanda, thanks for the update. Since auditpol confirms Success/Failure and you've restarted, the issue might be with how the lock/unlock events are triggered or filtered. Please double-check that your custom view includes Event IDs 4800 and 4801 and that the date range isn't too narrow. Also, ensure you're locking the PC using Windows + L or letting it auto-lock some methods may not trigger those specific events.

     

    Chard

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.