Audit Category: Other Logon/Logoff Events (Vista and Windows Server 2008)

This Page is locked
Modified: 2008/01/15 14:34 by Randy Franklin Smith - Uncategorized
This category groups together logon related events associated with screen saver, console locking and Remote Desktop connections. To configure this category you must use auditpol.

Event IDTitle
4778A session was reconnected to a Window Station.
4779A session was disconnected from a Window Station.
4800The workstation was locked.
4801The workstation was unlocked.
4802The screen saver was invoked.
4803The screen saver was dismissed.


Additional Links

A
D
V

Sick of LimitLogin? Get UserLock for real logon control

NEW! GFI EventsManager 8 Extends Event Management Capabilities. Find Out More.

Get Randy's Security Log Resource Kit

Ultimate Windows Security is a division of Monterey Technology Group, Inc. ©2006-2008 Monterey Technology Group, All rights reserved. Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. Terms and conditions.