Registering locking and unlocking of workstations

Hey,

LEM can detect the Logon Type - you can then create a filter/rule to capture Lock/Unlock events.

Lock:

Filter Conditions:

Unlock:

Filter Conditions:

Equally you could create a filter based on the event ID's (4800/4801)

Hope that helps!

As a requirement to getting those events, you will need to be running the LEM Agent on your workstations (workstations do not replicate "lock" and "unlock" events to the DCs).  You'll also need to make sure that your Windows Audit Policy (whether in local or GPO) is setup to tell Windows to make those events.

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4800

If both of these things are true, than jhynds​'s answer is one of multiple ways to find those lock and unlock events.

So, a super crappy thing to note here, in my experience to date the "lock" event only gets fired when the "unlock" event gets fired, and not when the workstation actually gets locked. I really hope this changed in Windows 10, but every other version I worked with didn't actually log the lock until it logged the unlock, and you see them together

Thank you so much everybody.  All the answers have been super helpful.  I also used the ProviderSID as well (Microsoft-Windows-Security-Auditing 4800/4801) which with all your help was able to narrow down exactly what I was looking for.

Again, thank you all for your help

"All Hail Thwackers"

Without enabling that event ID GPO, does the events logged in Local PC or domain controllers?