A way to log when a workstation Locks?

[n8]

I would like to know when a workstation is locked or logged off of. Is
there a way for the event viewer can record this???

Thank you,
-n8

 

[Torgeir Bakken \(MVP\)]

I would like to know when a workstation is locked or logged off of.
Is there a way for the event viewer can record this???

Hi

If you enable auditing of logon events, you will find entries for
logoffs in the security event log, but sadly, not for locking the
computer (but an entry is created for computer unlocking though).

Auditing of logon events has to be enabled on the computer via Local
Security Policy or possibly domain level if in a domain. Then you can
search the security log for the following event to see when an
interactive logoff was done:

Event ID 538 where the description lists Logon Type 2


HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399