We have to calculate the Utilization of the system (PC\Laptop) based on the Windows events logs (4800 & 4801). 4801 --> This log denomination indicates the system has been Unlocked 4800 --> This log denomination indicates the system has been Locked The time difference between the 4801 to 4800 events is considered as Utilization period. As we are working on the Night shifts we have encountered a scenario where  we are receiving the 4801 event entry for that particular day  & 4800 entry never returns on the same day since the system will not be locked.   Hence we would need help in calculating the Utilization period for the users between 6pm to 4am. As there will be change in the date for the mentioned time frame, we are unable to calculate the Utilization for the day due to the aggregate functions. Kindly provide us your suggestions which could be possible solution. ... View more