IF you are auditing Account Logons on your DCs AND have "Interactive
logon: Require Domain Controller authentication" to unlock policy
applied to the system in question unlocks will be audited on the DC. The
policy setting requires a DC to unlock rather than cached credentials so
I'm sure you can imagine how that could be problematic.

I am pretty sure that XP can't audit the locking itself

-----Original Message-----
From: Bryan Garmon [mailto:[email protected]] 
Sent: Wednesday, October 07, 2009 7:59 AM
To: NT System Admin Issues
Subject: Capture Locking and Unlocking

In Windows XP SP3 or later does the OS record when a user has locked
or unlocked a machine, ie when they hit ctr-alt-del then enter?

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/>  ~

~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/>  ~

Reply via email to