Re: "Lock Computer" Log

From: Steven L Umbach (n9rou_at_nscomcast.net)
Date: 06/24/04 

Date: Thu, 24 Jun 2004 16:49:37 GMT

First auditing of logon events has to be enabled on the computer via Local
Security Policy or possibly domain level if in a domain. Then you can search
the security log in Event Viewer for Event ID's 528 [logon] and 538 [logoff]
but only for logon type 7 which indictes the the computer was
locked/unlocked. --- Steve

http://is-it-true.org/nt/atips/atips155.shtml

"Dane" <anonymous@discussions.microsoft.com> wrote in message
news:20f0a01c459f7$f9c88a00$a501280a@phx.gbl...
> Is it possible to determine when a user has locked their
> Win 2K workstation and when they unlocked it for any given
> period of time?

Relevant Pages

  • Re: whos loggin on when?
    ... future logon events in Event Viewer using the procedure ... click on Local Security Policy. ... In the Local Security Policy editor, ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.general)
  • Re: Monitoring user access.
    ... Security Policy. ... In the right hand pane, right click on Audit logon events. ... Keep in mind that if you're running XP Professional, enabling auditing of logon ...
    (microsoft.public.windowsxp.security_admin)
  • Re: How do I find out when user XXX logged in+out on last Tuesday? Event log entry possible?
    ... You can do that through the local security policy. ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Windows XP User logs
    ... You can do that through the local security policy. ... In the right hand pane, right click on Audit logon events. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Monitor Hacker acitivities
    ... Enable auditing of logon events in the security policy for your DC - either at Domain ... That is done if for instance you have a web server - port 80/443tcp, ... port 1723/1701, remote access - port 3389tcp available to users, or other services. ...
    (microsoft.public.security)