Audit "Lock Computer" events

From: Jody Cohen (jcohen_at_catalysttech.com)
Date: 10/25/05 

Date: Tue, 25 Oct 2005 16:19:33 -0400

Hi,

I'm trying to audit and monitor when a user locks their computer by choosing
"lock computer." I'm sure these types of events are being logged but I was
curious to know if anyone is doing this or if I need to figure out on my own
which events in the security log are indicative of this action.

Any help you can provide is greatly appreciated.

Thanks,
Jody Cohen