On Wed, Oct 7, 2009 at 10:58 AM, Bryan Garmon <[email protected]> wrote: > In Windows XP SP3 or later does the OS record when a user has locked > or unlocked a machine, ie when they hit ctr-alt-del then enter?
Not by default. You can definitely configure it to log when the workstation is unlocked. You have to enable logon auditing (SECPOL.MSC). It then shows up in the "Security" log as a logon, with type 0x7 in the description. I'm not sure, but I don't think XP can log when a station is locked. I know Vista can. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
