Event Log When A Desktop Was Locked

When you need to find out when a workstation has been unlocked then you need to find in the security log events that ID's are reporting
You will need eventID 4801

get-eventlog security | Where {$_.EventID -eq 4801}

Powershell

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License