Is it possible to track the event when a user manually locked the station (by pressing Windows + L) in event viewer or in the registry?
I am using Windows 7 Home Premium 64 bit.
Asked
Active
Viewed 7,716 times
1 Answers
0
you will have to do some experimentation to determine the exact footprint based on your network configuration (ad/kreberos vs sam, automatic locking with screensaver, etc), but look for event log id 4800 to indicate locking, and 4801/4803/4624 for unlock/logon.
Mpre info here: http://technet.microsoft.com/en-us/library/dd772658%28v=WS.10%29.aspx
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
Frank Thomas
- 37,476