"lock computer" event id

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

using XP Pro SP2

when I lock the computer (Ctrl-Alt-Del Lock Computer) what event if any is
recorded in the event viewer?

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I don't use the older style log on, so I can't be positive, but the new Welcome Screen causes an event 538 when the computer is "locked" using the Win key and L.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"kevin" <kevin@discussions.microsoft.com> wrote in message news:8BACFE55-EB99-43FF-8E59-AF3A54F1C675@microsoft.com...
> using XP Pro SP2
>
> when I lock the computer (Ctrl-Alt-Del Lock Computer) what event if any is
> recorded in the event viewer?

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Kevin-

The event id is 680.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"kevin" <kevin@discussions.microsoft.com> wrote in message
news:8BACFE55-EB99-43FF-8E59-AF3A54F1C675@microsoft.com...
> using XP Pro SP2
>
> when I lock the computer (Ctrl-Alt-Del Lock Computer) what event if any is
> recorded in the event viewer?

Also, when you *unlock* a workstation, you'll see Event ID 528 "Successful
logon" with type 7


fyi...
Type 2: Interactive logon (someone at console)
Type 3: Network logon -
Type 4: Batch logon
Type 5: Service logon
Type 6: Proxy logon
Type 7: Unlock Workstation

--
Colin Nash
Microsoft MVP
Windows Shell/User