On Wed, Jan 18, 2012 at 1:32 PM, Jonathan Link <[email protected]> wrote: > Also, doesn't a lock/unlock count as a logoff/logon? I'm usre about the > unlock being a login event. Not sure about the lock...
As far as I can tell, the console locking is not a logon or logoff event. It may be logged in the Security log (depending on the version of Windows, Service Pack, configured options, phase of the moon, etc.), but it doesn't result in a logon session being created or destroyed. Unlocking the console results in a logon *and* a logoff event. Apparently Windows actually creates a logon session object just to verify the credentials provided. So you get a logon event for that. Then it immediately destroys that logon session, so you get a logoff event. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
