0

I have a task that is triggered on PC1 whenever the user locks their computer. This works fine.

enter image description here

I just set it up the same on PC2, but the Event ID 4800 is not logged on this machine when the user locks the screen. The only difference I can see between the machines is PC2 is "for Workstations".

Is there a way to enable logging of 4800 Event ID? I tried using 4634 (Logoff), but for some odd reason it made my task fire all the time? Even though 4634 only showed up in the security log when I locked the computer.

PC1 - Windows 11 Pro, ver 23H2, OS Build 22631.3593

PC2 - Windows 11 Pro for Workstations, ver 23H2, OS build 22631.3593

Improve this question
4
  • 1
    You have to enable the audit logs you can enable Audit Other Login/Logoff Events by editing the local group policy
    – Ramhound
    Commented May 30 at 17:22
  • Nice, thank you. With gpedit I navigated Computer Configuration->Windows Settings->Security Settings->Advanced Audit Policy Configuration->System Audit Policies - Local Group Policy Object->Logon/Logoff to find Audit Other Logon/Logoff Events.
    – relayman357
    Commented May 30 at 21:33
  • @Ramhound if you want to make that an answer I'll accept it. Thank you
    – relayman357
    Commented May 30 at 21:37
  • Once I have the ability to create a couple screenshot I will do exactly that.
    – Ramhound
    Commented May 30 at 22:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .