locked
System lock event in event viewer XP RRS feed

  • Question

  • Hello,

    Does Win XP add system lock event (start+L OR Ctrl+Alt+Del) in event viewer under security tab? I am able to find unlock entry.

    Thursday, April 4, 2013 8:15 AM

Answers

  • Unfortunately, for Windows XP workstation, no event is recorded when a
    workstation is locked manually or locked by screen saver. Only unlock event
    will be recorded when the workstation is unlocked. To audit the unlock
    events, you need to enable logon/logoff auditing for successful and failed
    events on XP workstations.

    To do this, please:

    1. Click Start -> Control Panel -> Administrative Tools -> Local Security
    Policy
    2. Click the left snap-in and extend Local Policies
    3. Open Audit logon events in Audit Policy and check the Success and
    Failure boxes and press OK.

    Unlock : Event ID : 528, Logon type : 7


    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Proposed as answer by antb11 Saturday, April 6, 2013 5:12 PM
    • Marked as answer by arnavsharmaModerator Wednesday, June 5, 2013 5:00 AM
    Friday, April 5, 2013 5:50 PM
    Moderator
  • You can Google if there's some third party applications. 

    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Proposed as answer by antb11 Tuesday, April 9, 2013 9:27 AM
    • Marked as answer by arnavsharmaModerator Wednesday, June 5, 2013 5:00 AM
    Monday, April 8, 2013 4:58 PM
    Moderator

All replies

  • Unfortunately, for Windows XP workstation, no event is recorded when a
    workstation is locked manually or locked by screen saver. Only unlock event
    will be recorded when the workstation is unlocked. To audit the unlock
    events, you need to enable logon/logoff auditing for successful and failed
    events on XP workstations.

    To do this, please:

    1. Click Start -> Control Panel -> Administrative Tools -> Local Security
    Policy
    2. Click the left snap-in and extend Local Policies
    3. Open Audit logon events in Audit Policy and check the Success and
    Failure boxes and press OK.

    Unlock : Event ID : 528, Logon type : 7


    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Proposed as answer by antb11 Saturday, April 6, 2013 5:12 PM
    • Marked as answer by arnavsharmaModerator Wednesday, June 5, 2013 5:00 AM
    Friday, April 5, 2013 5:50 PM
    Moderator
  • Hello Arnav,

    Thanks for your reply.

    Is there any other option to track workstation Lock event.

    Monday, April 8, 2013 12:32 PM
  • You can Google if there's some third party applications. 

    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Proposed as answer by antb11 Tuesday, April 9, 2013 9:27 AM
    • Marked as answer by arnavsharmaModerator Wednesday, June 5, 2013 5:00 AM
    Monday, April 8, 2013 4:58 PM
    Moderator