Audit Event for CTRL-ALT-DEL

How can I create an event on a users computer to log/record everytime they lock their computer on the domain with a time stamp?
crjaqAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
arnoldCommented:
You can tell when they unlocked the sytem, but I do not think there is an event that shows that they locked or the computer went to sleep.
there are tools i.e. monitor if a screen saver kicks in.

resuming a logged in session the logon type will be 7
http://www.windowsecurity.com/articles/logon-types.html

I gather you want something like:
http://www.track4win.com/
0
crjaqAuthor Commented:
On Win7, there's an event ID 4800 that records when a user locks their computer on their own computer but is there a policy in AD 2008 that can be enabled to time stamp that ID as well?
Thanks.

0
arnoldCommented:
Not sure what you mean, when the Event is recorded/added it has a time stamp.
You could use tools that aggregate event logs or use SNMP/WMI with evntwin and an SNMPTRAPD server to collect the traps generated based on configured events to SNMP maps.
0
crjaqAuthor Commented:
What I meant was on the domain controller, it records every user logging on/off but not when a user locks his/her computer.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.