Thursday, November 30, 2017

Windows 7: What is the event ID for a lock event and how to tell if it is user-initiated or not?

The following eventvwr.exe event relates to a screen unlock event:


Event ID 4624 (access type: 7) (screen unlock)


Now I need to find the screen lock event, so I can compare the time between when I left the apartment and when the screen locked. If the difference is more than what is set as the screen lock time in the control panel, I will know someone logged on while I was away. Thanks.


NOTE:


I'm confused because this post tells another story.

No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...