Re: Security Event Logging

From: Steven L Umbach (
Date: 10/27/04

Date: Wed, 27 Oct 2004 19:07:27 GMT

Check your logs for Events 528 and 538 or other logon events with type 7
logons. Type 7 indicates that the computer was locked/unlocked. You can use
Event Comb to remotely scan for this information to make the job easier. It
is available at the link below. --- Steve

"Charles Blair" <> wrote in message
>I already have security logging for successful logon/logoff, and I was
> wondering if there was a way to log when a user locks/unlocks their
> desktop.
> Charles