Security

A user came to see me today and stated that he was 100% sure he closed his PC before leaving to go home. However this morning when he came in he found his Pc open and logged in. Is there a way I can tell if this actually happened and at what time?
Nt DOMAIN and Nt workstation…