I don't use the older style log on, so I can't be positive, but the new Welcome Screen causes an event 538 when the computer is "locked" using the Win key and L.
Also, when you *unlock* a workstation, you'll see Event ID 528 "Successful
logon" with type 7
fyi...
Type 2: Interactive logon (someone at console)
Type 3: Network logon -
Type 4: Batch logon
Type 5: Service logon
Type 6: Proxy logon
Type 7: Unlock Workstation
Ask a Question
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.
