Looking for an app to detect windows locks/unlocks

Posted on 2006-05-22
Last Modified: 2006-11-18
Basically, I have an employee who is constantly locking their computer and leaving for several minutes and coming back and unlocking their computer. Normally we don't care, but the frequency is getting extreme, and before we approach him about it, we want to find out how many times he does this per day and how long he's away. I've tested some keyloggers, but they only record the keystrokes leading up to the lock.

So if the user presses Windows key + L to lock the computer, the keyloggers will only record the Windows key. Or if they use Ctrl+Alt+Del to get into the menu where they can lock the computer, the keylogger will only see the Ctrl+Alt, but no Del. And when the computer is unlocked, there's no record of the Ctrl+Alt+Del combo to initiate the unlocking. So does anyone know of a key logging program or something that will just monitor the locks and unlocks of a workstation? Obviously, it would have to be a stealthy program to avoid detection.

Question by:gr8gonzo
    LVL 10

    Accepted Solution

    How about a utility that parses the event log for Account Lockout events? I use GFI's Event Log Monitor.
    LVL 6

    Assisted Solution

    Just out of curiosity, why exactly is this a problem?  Surely you'd want to encourage users locking their desktops while they're not at their computers?  (Just curiosity really)

    Right, now that I've got it out of the way, what you want to be doing is first ensuring that these events are logged.  Fire up your Group Policy editor, and expand:
    Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policies

    Turn on Success and Failure events under "Audit logon events"  (if you already have a domain wide policy in place its all good)

    You'll see events 528 and 538 logged in your system's Security log.  Now that's for all logons, so to narrow it down you want to be looking at the Logon type - 7's the magic number here.  Basically, you just want to parse the logfile on the machine, and pull out all 528/538s, and then count the number with logon type 7.  

    Let me know if you want a Logparser query that will give you a handy little report with number per day etc.  (I'm just leaving for home noe, so I can only get to it tomorrow morning)


    Featured Post

    Courses: Start Training Online With Pros, Today

    Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    Topology Software 6 64
    Search also sub-folder 1 51
    URL to download Windows 10 Home 2 72
    Image Deployment Tool 9 46
    This article shows how to convert a multi-page PDF file into multiple image files, with one image file created for each page of the PDF. It does this by utilizing an excellent, free software package called GraphicsMagick. The solution is amazingly s…
    Today companies are subjected to more-and-more data, and it won't stop any time soon.  But there are obvious opportunities for reducing data, particularly data duplicated among companies.
    This video demonstrates basic masking and how to edit the mask to reveal the desired image.
    XMind Plus helps organize all details/aspects of any project from large to small in an orderly and concise manner. If you are working on a complex project, use this micro tutorial to show you how to make a basic flow chart. The software is free when…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now