Expand Login Event reporting to include lock/unlock

6 months agoopen0

Would be great if workstation lock/unlock events were included as an option with the login/logoff reporting under “Administration/Diagnostics > System Information > Login Events” for historical reporting of when a user session has been locked on a workstation and when the user signed back in to an active session (unlocked) the workstation. Believe these are Windows Event IDs 4800 and 4801.

Leave a Comment

four × three =