IF you are auditing Account Logons on your DCs AND have "Interactive logon: Require Domain Controller authentication" to unlock policy applied to the system in question unlocks will be audited on the DC. The policy setting requires a DC to unlock rather than cached credentials so I'm sure you can imagine how that could be problematic.
I am pretty sure that XP can't audit the locking itself -----Original Message----- From: Bryan Garmon [mailto:[email protected]] Sent: Wednesday, October 07, 2009 7:59 AM To: NT System Admin Issues Subject: Capture Locking and Unlocking In Windows XP SP3 or later does the OS record when a user has locked or unlocked a machine, ie when they hit ctr-alt-del then enter? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
