Re: Security Event Logging

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 10/27/04


Date: Wed, 27 Oct 2004 19:07:27 GMT

Check your logs for Events 528 and 538 or other logon events with type 7
logons. Type 7 indicates that the computer was locked/unlocked. You can use
Event Comb to remotely scan for this information to make the job easier. It
is available at the link below. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

"Charles Blair" <charles_blair@hotmail.com> wrote in message
news:eRQWxyDvEHA.1976@TK2MSFTNGP09.phx.gbl...
>I already have security logging for successful logon/logoff, and I was
> wondering if there was a way to log when a user locks/unlocks their
> desktop.
>
> TIA
>
> Charles
>
>