Hi,
I am having password protected screensaver policy. Its working fine, getting events generated in client machine. I want to know the clear explanation of each events coming regarding to this group policy. Events mentioned below.
Audit Success8/4/2012 15:04Microsoft-Windows-Security-Auditing4801Other Logon/Logoff Events"The workstation was unlocked.Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 15:03Microsoft-Windows-Security-Auditing4800Other Logon/Logoff Events"The workstation was locked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 15:03Microsoft-Windows-Security-Auditing4803Other Logon/Logoff Events"The screen saver was dismissed.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 14:36Microsoft-Windows-Security-Auditing4802Other Logon/Logoff Events"The screen saver was invoked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 14:15Microsoft-Windows-Security-Auditing4801Other Logon/Logoff Events"The workstation was unlocked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 14:15Microsoft-Windows-Security-Auditing4800Other Logon/Logoff Events"The workstation was locked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 14:15Microsoft-Windows-Security-Auditing4803Other Logon/Logoff Events"The screen saver was dismissed.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 13:59Microsoft-Windows-Security-Auditing4802Other Logon/Logoff Events"The screen saver was invoked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 13:30Microsoft-Windows-Security-Auditing4801Other Logon/Logoff Events"The workstation was unlocked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 13:30Microsoft-Windows-Security-Auditing4800Other Logon/Logoff Events"The workstation was locked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 13:30Microsoft-Windows-Security-Auditing4803Other Logon/Logoff Events"The screen saver was dismissed.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
Audit Success8/4/2012 13:15Microsoft-Windows-Security-Auditing4802Other Logon/Logoff Events"The screen saver was invoked.
Subject:
Security ID: test\vino
Account Name: vino
Account Domain:test
Logon ID: 0x73ce0
Session ID: 1"
I checked some websites, in that they mentioned screensaver dismissed event will come when the user unlocks the computer. In that case workstation unlocked event and screensaver dismissed event time should be same right. But in my case screensaver invoked and dismissed event almost same time. Anyone please clarify this.....