Eventviewer eventid for lock and unlock

windows event-viewer
user1500194 picture user1500194 · Jul 8, 2012 · Viewed 113k times · Source

What is the event id in Event Viewer for lock, unlock for a computer in Windows XP, Windows 7, Windows Vista and Windows Server 2008?

Answer

eran picture eran · Jul 8, 2012

The lock event ID is 4800, and the unlock is 4801. You can find them in the Security logs. You probably have to activate their auditing using Local Security Policy (secpol.msc, Local Security Settings in Windows XP) -> Local Policies -> Audit Policy. For Windows 10 see the picture below.

Look in Description of security events in Windows 7 and in Windows Server 2008 R2 under Subcategory: Other Logon/Logoff Events.

Other Logon/Logoff Events in Windows 10

Related questions

Time when Windows 7 was started/booted

I want to check the operating system's start time. That is, for the last one month, the times when Windows was booted up. Is it possible to find this out?

Read More
Application Event log exceeding maximum allowed count

Somehow, the Application Event log count ended up to 18,446,744,073,709,551,499. This causes MMC snap-in to fail when I want to see the event using Event Viewer, giving a System.OverflowException (Value was either too large or too small for an Int64.). …

Read More
Windows.old event viewer logs

Is it possible to see old event log files, those that you can see in event viewer? But I only have windows.old folder available. Situation is that, that some of our company's computers were hacked. I want to check …

Read More