Does Windows XP keep a log of the login and screen locking events? If so, how can I view it?
asked Sep 16, 2009 at 0:11
Add a comment
|
3 Answers
Logon events are in the event viewer under Security. I don't think desktop locking is audited.
-
And how would I search for those events? The event viewer logs are rather lengthy. Sep 16, 2009 at 0:16
-
You can filter the events for what you are searching for. You can do this by opening the event viewer log and right clicking on the log name and choosing "Filter". Sep 16, 2009 at 0:30
-
Thanks. I've filtered by login name and I don't see any login events, or events for today even. Any other ideas? Sep 16, 2009 at 0:42
-
Do you have auditing enabled for logon events? If so, are you auditing both Success and Failure events? Sep 16, 2009 at 3:06
-
Be aware that in XP by default auditing is turned off, so you need to start by enabling it. Sep 16, 2009 at 5:48
Whether these events ARE audited is another question. I don't recall the defaults. To ensure they are, Go to Control Panel, Administration Tools and run Local Policy Settings. In there under audit policies, there are two different login events listed. Enable success and failure for both.
Then in Computer Manager, right click the Security event log and expand its size to 8MB and set Overwrite as needed (unless you really MUST KNOW, then select do not overwrite). 8MB should give you enough overhead to ensure the events are there when you look.
(WARNING: do not enable successful 'audit object access'. This will generate an event for every file & registry key access and will likely bring it to a crawl.)
\\Greg
There may be some more hinst and tips in this question :
