Windows Forum

Ask something
Discussion Locked

Monitor Lock/Unlock Computer Event

0 helpful
3 replies

by jeremy the it guy 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Is there a way to tell when a user locks/unlocks their computer? I have told all employees to lock their workstations before leaving there offices at night. I am having some salary employees taking advantage of the fact that they are on salary andI'd like to know when the user gets here by logging their unlock computer event. Does anyone know how I can achieve this? Thanks, Jeremy

3 replies

by vpnetadmin

You can accomplish this by auditing the security event logs. Under Security Log properties, go to filter & check the Success audit. Event source & Category should set to [all]. If not at least in event source set to "security". When the user lockedtheir workstation , it will write the event log - (Security log) as category logon/logoff, & event ID 528. & when the user logged in back, it will write event as 538 , as category logon/logoff .It will show the time stamps too, so that you can monitor the users logon/logoff timings.
Hope this will help you. Considered users having W2K prof/Nt workstations.

by jeremy the it guy

I knew the answer for logging on and logging off but I need to be able to monitor lock/unlocking of the machine. Thanks, Jeremy

This discussion is closed to new replies.