SEM - Monitoring user not locking their screen when inactive

m.a

Hello guys,

Before sending everyone working remotely at home, I used to take a walk from time to time around the building to see if unattended computers were locked.

Now that we are all at home, I am hoping the employees are still keeping that good habit of locking their screen when leaving their computers, and i was wondering if someone here perhaps had an hindsight on if I could have that kind of monitoring done with SEM.

Thank you !

neomatrix1217

You could try something like this.

Those events are logged at machine locally in case auditing is enabled (Computer Configuration-Windows Settings-Security Settings-Advanced Audit Policies-Logon/Logoff-Audit Other Logon/Logoff Events). you can remotely check Security logs for event id  4800 (locked)  4801 (unlocked)

Powershell

get-eventlog -newest 1 -LogName Security -computername <ServerName> | where {$_.eventID -eq 4800}