On Wed, Mar 5, 2008 at 1:09 PM, Joe Heaton <[EMAIL PROTECTED]> wrote: > So what you're saying is that the actual Event Viewer entry for a user > logging into the network would be on the workstation, not the server?
The regular logon (from the startup logon screen) can generate audit events on the local workstation and/or the DC, depending on how you've configured the audit policies. But unlocking a locked session (CTRL+ALT+DEL, "Lock Computer") doesn't need to check in with the DC, so it only generates local audit events. So if you're trying to watch for that, you need to monitor the workstation logs somehow. -- Ben ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
