In windows XP, can i log user login/logoff and lock/unlock actions

Question

Let me preface by saying I am extremely forgetful.

I would like to have a log when I login, logout, lock and unlock my workstation.

(in my case so i can track the nunmber of hours i spend at the PC)

the EventViewer is alomst good enought. The Security view show Logon/Logoff events. I just need to know the Lock/Unlock events also.

or a method to call a script on those events so i can do the logging myself.

Solution 1

You know, there's a cheap little bluetooth device out there that might help you.

You plug it in to your USB port and keep the "dongle" in your pocket.

When you walk away from your PC (say 6 feet or so) the computer automatically locks. When you come back within range it automatically unlocks.

UPDATE:

I finally found the one I have. Its a PC Defender Wireless Screen Lock. Not sure if they sell them anymore but I've seen plenty of them out there at places like Fry's Electronics, etc. Here's a link to show you what one looks like:

http://www.dansdata.com/pclock.htm

On that note... there are also programs out there such as Blue Lock 1.92 and others which can tie in to the Bluetooth on your phone and perform certain actions (usually lock the screen) when you walk away from your PC (taking your phone with you).

---

Another solution would be to use your webcam to take periodic screenshots, say every 5min. Then just count the shots that have your face in them. Microsoft has a Power Toy that does this. Also doubles as a security camera. ;-)

Solution 2

Unfortunately there is no "lock" workstation event -- unlocking (with the correct audit settings turned on can trigger a pair of 528/538 events with a type of '7'.

A better idea might be to look at the various tools out there that can traack machine usage for billing purposes. They can usually give you a list of what application had focus during what time frame.

We use Spector 360 to do this on a network wide scale.

Solution 3

For anyone who likes to know how to do this in Windows 7 (like me): Open Local Security Policy (can be found by pressing the Windows key once and typing "Local Security Policy") => Advanced Audit Policy Configuration => ... => Logon/Logoff => Audit Other Logon/Logoff Events => double click and mark all the check boxes => save

Screenshot: Audit Other Logon/Logoff Events

Now you get the events in the Event Viewer under Windows Logs => Security (Event IDs 4800 and 4801)

Solution 4

We have a login and logoff script that runs via group policy that logs to a file each time someone logs in or off - that might help? Login file contains the following (set up the \server01\audit$ share first!)

@echo %username%,%date%,%time%,%computername%,%clientname% >>\\server01\audit$\%username%login.txt

Solution 5

There is a "logon type" for "Unlock Workstation" (type 7) that will get logged into the event log. I'm not sure this going to give you want you want, though.

The easiest way to do what you want would be to run a user-land program that you interacted with to keep time records.

You could develop a GINA library that log your own events when a lock workstation or unlock workstation occured, since both of those events have callbacks into the GINA. (In Vista, GINA was replaced with Credential Providers and it's not immediately clear to me if they get a callback when a lock workstation occurs or not.)

View more solutions

Comments

[KPWINC]

LOL... how hard did you look my friend? A google of "Wireless PC Lock" still turns up LOTS of results. Try here: google.com/products?q=wireless+pc+lock