Expand Login Event reporting to include lock/unlock

1 year agoopen0

Would be great if workstation lock/unlock events were included as an option with the login/logoff reporting under “Administration/Diagnostics > System Information > Login Events” for historical reporting of when a user session has been locked on a workstation and when the user signed back in to an active session (unlocked) the workstation. Believe these are Windows Event IDs 4800 and 4801.

Leave a Comment

one × 1 =