I need to be able to determine when computers are locked and unlocked by users. Unlocking produces an Event ID of 528, Type 7. How can I audit when the computer is locked since, from what I can tell, there is no Event ID produced.
2006-09-28 07:54:36 · 2 answers · asked by Anonymous in Computers & Internet ➔ Security
I get an event 528 when I log back on but that may be somewhat different than just an unlock since I have to authenticate.
2006-09-28 08:15:02 · answer #1 · answered by Travis H 1 · 0⤊ 0⤋
Try this (It works for Windows Vista, maybe it would work for you):
• The Event ID 538, is the event identification number that is generated when you log on to a locked computer, or
• Maybe here you could find a event id that could help you: KB related to W2k security event descriptions at
http://support.microsoft.com/kb/299475
2006-09-28 14:43:29 · answer #2 · answered by gospieler 7 · 0⤊ 0⤋