What exactly causes Event ID 4803 Expand / Collapse
Posted 4/28/2020 5:11:14 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/29/2020 1:28:49 PM
Posts: 2, Visits: 3
My company has a program that reads all the security logs of our workstations every few hours. The purpose is to get a general idea on how much 'work' people are actaully doing. for the most part, the reports this spits out looks good, except for a few minor things. With GPO, windows workstations (win10) will do the generic timeout with a screensaver and lock the workstation (providing they didn't lock it when the wolked off). user returns, unlocks the workstation and does whatever they do.
So, back to my isssue..... I have a workstation that recorded Event ID 4803 (screensaver dismissed) at 1:47 am on a Sunday. Our company is only open Mon.thru friday 6 am->6pm. THe user are this workstation is NOT able to remote in. at 2:06am. there was event 4802 (screensaver invoked) Nothing elese between those times (other than normal windows event chatter) No event 4801 (unlocked) no event 4800 (locked) etc.....

so there must be something that causes event 4803 to get recorded other than a person getting ready to log in. any ideas?
Post #8629
« Prev Topic | Next Topic »

Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:31pm