Financial Information
How to audit user Computer Lock?
Question : How to audit user Computer Lock?
I need to be able to determine when computers are locked and unlocked by users. Unlocking produces an Event ID of 528, Type 7. How can I audit when the computer is locked since, from what I can tell, there is no Event ID produced.
computer audit
Best answer:
Answer by Travis H
I get an event 528 when I log back on but that may be somewhat different than just an unlock since I have to authenticate.
Try this (It works for Windows Vista, maybe it would work for you):
• The Event ID 538, is the event identification number that is generated when you log on to a locked computer, or
• Maybe here you could find a event id that could help you: KB related to W2k security event descriptions at
http://support.microsoft.com/kb/299475