Link to home
Start Free TrialLog in
Avatar of Mike
MikeFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Task Scheduler Task from Logon Event 4624

Hi. I am trying to create a warning message that fires if anyone remotely logs into my stand-alone Win 7 pc. I know how to make Task Scheduler start a task to launch a warning message box upon logon Event ID 4624. What I would like is to restrict that so that the the task only fires if the logon is either Logon Type 3 (network) or 10 (terminal services etc).

Is that doable?

 Cheers.
Avatar of McKnife
McKnife
Flag of Germany image

Yes. Modify the event trigger, customize its xml manually. I can add an example soon.
I have the solution, look at this picture:
User generated imageThe custom event filter xml text is
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and (Data=3 or Data=10)]]</Select>
  </Query>
</QueryList>

Open in new window

Avatar of Mike

ASKER

Works like a charm. Many thanks.
ASKER CERTIFIED SOLUTION
Avatar of McKnife
McKnife
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Mike

ASKER

Thanks again Mac.