Security Event Logging

[Charles Blair]

I already have security logging for successful logon/logoff, and I was
wondering if there was a way to log when a user locks/unlocks their desktop.

TIA

Charles

 

[Lanwench [MVP - Exchange]]

No, not that I know of. What is it you wish to track?

 

[Charles Blair]

I want to track the working hours of certain employees on their
workstations.

Unfortunately, some of the employees lock their workstations so their is no
log of when they are actually on their workstation.

I considered removing the "Lock Computer" ability, but it is much too useful
for emplyees who need to secure their workstations and leave their area for
lunch, breaks, meetings, etc.

I may just have to create a task that will record timestamps when the system
is idle and parse out reports from there.

Any other ideas are greatly appreciated.

Charles

"Lanwench [MVP - Exchange]"

 

[Steven L Umbach]

Check your logs for Events 528 and 538 or other logon events with type 7
logons. Type 7 indicates that the computer was locked/unlocked. You can use
Event Comb to remotely scan for this information to make the job easier. It
is available at the link below. --- Steve

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en