Blue-Fingers

Has anyone ever captured or monitored locking and unlocking a workstation? Much like capturing the logon/logoff event, I'm interested in monitoring the lock/unlocking of a workstation.


Regards,
BF

__________________
Blue-Fingers
Just doin that Altiris thing

TRYDL

I know this is a late reply, but I did want to toss in my own $0.02

I dont believe Lock Workstation can be audited, but the Unlock can be. IIRC, it was seen as synchronous logon / logoff pair.

Microsoft Corporation

If you are using Monitor Solution, you can easily harvest Event IDs and then trigger events. You could also do the same with a scheduled custom inventory scan.