Registering locking and unlocking of workstations

Hello Fellow Thwackers,

I am trying to see if I can register locking and unlocking of workstations.  This is more of an automated way to do a little grassroots testing, but wanted to see if it could be down.  I know it is Microsoft-Windows-Security Auditing 4800/4801, but I am not sure that LEM is built to capture that information.  Has anybody tried this?  If so, what is in your bag of tricks to make this happen.

Help????