"Lock Computer" Log

  • Thread starter Thread starter Dane
  • Start date Start date
D

Dane

Is it possible to determine when a user has locked their
Win 2K workstation and when they unlocked it for any given
period of time?
 
I don't believe you can audit that event. What's your goal, if you don't
mind my asking?
 
I want to see how often a particular user is locking their
computer - it's becoming an HR thing.
 
First auditing of logon events has to be enabled on the computer via Local
Security Policy or possibly domain level if in a domain. Then you can search
the security log in Event Viewer for Event ID's 528 [logon] and 538 [logoff]
but only for logon type 7 which indictes the the computer was
locked/unlocked. --- Steve

http://is-it-true.org/nt/atips/atips155.shtml
 
OK - see Steven's reply.
Personally, I'd be thrilled if more of my users would learn to lock their
computers while away from their desks!
 
Back
Top