Link to home
Start Free TrialLog in
Avatar of crjaq
crjaqFlag for United States of America

asked on

Audit Event for CTRL-ALT-DEL

How can I create an event on a users computer to log/record everytime they lock their computer on the domain with a time stamp?
ASKER CERTIFIED SOLUTION
Avatar of Nick Sitar
Nick Sitar
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of crjaq

ASKER

On Win7, there's an event ID 4800 that records when a user locks their computer on their own computer but is there a policy in AD 2008 that can be enabled to time stamp that ID as well?
Thanks.

Not sure what you mean, when the Event is recorded/added it has a time stamp.
You could use tools that aggregate event logs or use SNMP/WMI with evntwin and an SNMPTRAPD server to collect the traps generated based on configured events to SNMP maps.
Avatar of crjaq

ASKER

What I meant was on the domain controller, it records every user logging on/off but not when a user locks his/her computer.