Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, January 11, 2012 6:20 PM
As the name suggests i am trying to come up with an idea on how to do this.
Anyone have some ideas?
All replies (5)
Wednesday, January 11, 2012 7:33 PM ✅Answered
Not sure if this is a good answer or not, but if the machine has a current interactive logon session:
http://gallery.technet.microsoft.com/scriptcenter/0e43993a-895a-4afe-a2b2-045a5146048a
and there's a LogonUI.exe process running, I believe that means it's been locked.
[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
Wednesday, January 11, 2012 6:30 PM
I believe there is an event log entry for when a PC is locked. not sure what
the ID is, but its in the security log... that’s one way to do it.
Justin Rich
http://jrich523.wordpress.com
PowerShell V3 Guide (Technet)
Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Wednesday, January 11, 2012 7:01 PM
I peaked through there and am not seeing much.
Seems like i have activity when i logon but not when i lock.
Wednesday, January 11, 2012 7:10 PM
I read about this once, and I think its actually listed as a logoff or
something like that... base your searching on time...
lock/unlock and look at the events in that one minute period... im pretty
certain its in there...
the only other thing is there might be a certain type of auditing you need
to turn on but my gut is telling me you don’t need to screw with that.
Justin Rich
http://jrich523.wordpress.com
PowerShell V3 Guide (Technet)
Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Thursday, January 12, 2012 1:45 PM | 2 votes
My little bit of testing this appears to work.
I have a working powershell script that lets me know if a computer is logged in or not and then the LogonUI.exe does let me know if its sitting at the control alt delete screen or not.