The Logon Report is designed to deliver a list of all Logon, Logoff, Screen Lock and Screen Unlock events over a period of one full month for all computers within a single Client.  It can be run from the Report Center or from the 'Reports' context menu, on the Control Center.


All entries are organized first, by SAM Account name (Domain name and User name, separated by a '\'), then by computer, then by date.  This can be seen in the screenshot below.  All available events for the user DESKTOP-RGRVIA0\ROB are shown together.  When that user on that computer runs out of data, the next user in the list is shown.



In this example, we can see user DESKTOP-RGRVIA0\ROB only signed in and out; there were no screensavers launched from those sessions.  Starting with the top line, we can see this user:

  • Signed in at 4:31 PM on 3/20 and signed out the same day at 4:33 PM for a total sign-in duration of 2 minutes, 22 seconds.


The first line of our next user, HT\ROBERT isn't as obvious.  The event is listed as 'Unlock' and has two timestamps.  When the Event shows 'Unlocked', the two times show when it was unlocked and when it was locked again.  As with the Logon event, we are presented with a duration time.  This gives us the total unlock time of this session.  With user HT\ROBERT's first entry, we can see this user:

  • Unlocked the computer at 9:16 AM on 3/19 and locked it again the same day at 4:17 for a total unlock duration of seven hours, 45 seconds.


Combining these, we can see an entire logon session for any given user, punctuated by screen locks.  In this example below, we can see this user:

  • Signed on at 4:20 AM on 3/25 and signed off the same day at 8:48 PM for a total duration of 16 hours, 28 minutes and 24 seconds.
  • Locked the screen at 5:41 AM and left it locked until 10:48 AM the same day.  This resulted in the computer's total sign in time having two usable times: 1 hour, 21 minutes and 9 seconds before the lock and 10 hours and 13 seconds after the lock.



The next line shows a Logon Event, thus ending this session's logging.