Forum

Ultimate Windows Security Forum » Security Log » 531 - Logon Failure - Account currently... » Windows Screen Saver Failed Logins

Windows Screen Saver Failed Logins Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
dsax
Posted 4/21/2009 7:06:05 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/21/2009 6:57:16 AM
Posts: 1, Visits: 0
Hi,

Is there a way to differentiate when an account is locked due to screen saver failed logins from other locked account events?

Thanks,

dsax

Post #76
RandyFranklinSmith
Posted 4/21/2009 5:13:34 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
Yes, check the Logon Type.  Logon Type 7 indicates a Workstation Console Unlock.  Logon Types are documented on event ID 528 - click here
Post #77
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:16am