enable "other" logon and logoff events in gpedit.msc (win+r, gpedit.msc)
additional infos:
https://superuser.com/questions/528884/in-windows-7-how-to-query-times-when-the-computer-was-locked
short way to start a program on a given event in event-viewer:
https://technet.microsoft.com/en-us/library/cc748900(v=ws.11).aspx
