Re: Security Event Logging

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 10/27/04 

Date: Wed, 27 Oct 2004 19:07:27 GMT

Check your logs for Events 528 and 538 or other logon events with type 7
logons. Type 7 indicates that the computer was locked/unlocked. You can use
Event Comb to remotely scan for this information to make the job easier. It
is available at the link below. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

"Charles Blair" <charles_blair@hotmail.com> wrote in message
news:eRQWxyDvEHA.1976@TK2MSFTNGP09.phx.gbl...
>I already have security logging for successful logon/logoff, and I was
> wondering if there was a way to log when a user locks/unlocks their
> desktop.
>
> TIA
>
> Charles
>
>

Relevant Pages

  • Re: Security Event Logging
    ... Check your logs for Events 528 and 538 or other logon events with type 7 ... >I already have security logging for successful logon/logoff, ... > wondering if there was a way to log when a user locks/unlocks their ...
    (microsoft.public.windowsxp.security_admin)
  • Re: weird security logs
    ... >>> I'm getting a lot of authentication logs in the security logs on an ... > my security log logs when both login types have either success or failure. ... > and failure on both account logon events and logon events. ... > disabling the audit success on both and audit just fail. ...
    (microsoft.public.win2000.security)
  • Re: weird security logs
    ... > the browser service on all your machines (just stop it, don't disable, no ... >> I'm getting a lot of authentication logs in the security logs on an ... my security log logs when both login types have either success or failure. ... and failure on both account logon events and logon events. ...
    (microsoft.public.win2000.security)
  • Re: Need logon and Logoff data for 30 days
    ... Auditing of account logon events alone will not show when a user logs off. ... You would need to enable auditing of logon events [or just use logon events ...
    (microsoft.public.security)
  • Re: wkstation interactive logon recorded on DC?
    ... Enable auditing of account logon events in Domain Controller Security Policy ... Microsoft to remotely search the security logs of domain computers and the ...
    (microsoft.public.platformsdk.security)