Basically, I have an employee who is constantly locking their computer and leaving for several minutes and coming back and unlocking their computer. Normally we don't care, but the frequency is getting extreme, and before we approach him about it, we want to find out how many times he does this per day and how long he's away. I've tested some keyloggers, but they only record the keystrokes leading up to the lock.
So if the user presses Windows key + L to lock the computer, the keyloggers will only record the Windows key. Or if they use Ctrl+Alt+Del to get into the menu where they can lock the computer, the keylogger will only see the Ctrl+Alt, but no Del. And when the computer is unlocked, there's no record of the Ctrl+Alt+Del combo to initiate the unlocking. So does anyone know of a key logging program or something that will just monitor the locks and unlocks of a workstation? Obviously, it would have to be a stealthy program to avoid detection.