Just out of curiosity, why exactly is this a problem? Surely you'd want to encourage users locking their desktops while they're not at their computers? (Just curiosity really)
Right, now that I've got it out of the way, what you want to be doing is first ensuring that these events are logged. Fire up your Group Policy editor, and expand:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policies
Turn on Success and Failure events under "Audit logon events" (if you already have a domain wide policy in place its all good)
You'll see events 528 and 538 logged in your system's Security log. Now that's for all logons, so to narrow it down you want to be looking at the Logon type - 7's the magic number here. Basically, you just want to parse the logfile on the machine, and pull out all 528/538s, and then count the number with logon type 7.
Let me know if you want a Logparser query that will give you a handy little report with number per day etc. (I'm just leaving for home noe, so I can only get to it tomorrow morning)
Main Topics
Browse All Topics
by: victornegriPosted on 2006-05-22 at 10:39:14ID: 16736233
How about a utility that parses the event log for Account Lockout events? I use GFI's Event Log Monitor.