Hello Fellow Thwackers,
I am trying to see if I can register locking and unlocking of workstations. This is more of an automated way to do a little grassroots testing, but wanted to see if it could be down. I know it is Microsoft-Windows-Security Auditing 4800/4801, but I am not sure that LEM is built to capture that information. Has anybody tried this? If so, what is in your bag of tricks to make this happen.
Help????