Expand Login Event reporting to include lock/unlock

3 years agoopen0

Would be great if workstation lock/unlock events were included as an option with the login/logoff reporting under “Administration/Diagnostics > System Information > Login Events” for historical reporting of when a user session has been locked on a workstation and when the user signed back in to an active session (unlocked) the workstation. Believe these are Windows Event IDs 4800 and 4801.

Leave a Comment

5 × 4 =