Re: possible to log when a domain user locks workstation?

Reluctant Sys-Admin wrote:
I have a 2003 Server domain controller and XP workstations. I am trying to audit when domain users log on and off the domain for the day, however, certain users are not logging off but simply locking the workstation at the end of the day and unlocking it the next day. These events do not appear in the security events log on the domain controller. Is there any way to log when a user locks a workstation either on the domain controller OR on the local machine?

Yes -- use group policy to enable logon/logoff success auditing on the XP workstations.

Basically locking and unlocking a machine doesn't touch the network so the domain controller will never know -- instead you have to gather together the audit logs from the workstations.

Relevant Pages

  • Re: Auditing Account Logons
    ... Are you seeing this when viewing the security logs while logged ... > I need to audit when a user logs on to the domain from a workstation. ... > Domain Controller policy, I enabled "Audit Account Logon Events ...
  • Re: "Lock Computer" Log
    ... I want to see how often a particular user is locking their ... computer - it's becoming an HR thing. ... >I don't believe you can audit that event. ... >> Win 2K workstation and when they unlocked it for any ...
  • Re: Local admin rights not flowing through
    ... It sounds like it could be a problem with contacting the domain controller ... You can check the security log on the client workstation, ... assuming auditing of logon events is enabled as shown in Local Security ... >>> the profile. ...
  • Re: Refresh Problem
    ... If I wait 3 seconds between mouse clicks on the lock / unlock button, ... say locking, we immediately think RLOCK. ... workstation is looking at a current copy of the data. ... MESSAGEBOX statement after all of the database lookups have been done ...
  • Re: Slow login and difficulties accessing network reources
    ... Networking, Internet, Routing, VPN Troubleshooting on ... I have a remote site (with 4 workstation) connected over a VPN WAN ... Event Type: Error ... domain controller or the workstation, or is it the WAN connectivity between ...