Comments on: How To Create A Custom View To Filter All Lock Computer Events In Vista SP2? http://www.walkernews.net/2009/06/08/how-to-create-a-custom-view-to-filter-all-lock-computer-events-in-vista-sp2/ A capsule of walker's experience in life... Mon, 06 Feb 2012 19:09:42 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Pavel http://www.walkernews.net/2009/06/08/how-to-create-a-custom-view-to-filter-all-lock-computer-events-in-vista-sp2/#comment-15551 Pavel Wed, 10 Aug 2011 14:33:27 +0000 http://www.walkernews.net/?p=2726#comment-15551 In order to get it to work in Windows 7 you have to enable the "auditing" of events 4800 and 4801. In Local Group Policy editor go to: Computer Configuration -> Wndows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy -> Logon/Logoff. In subcategory (on the right) choose Audit Other Logon/Logoff Events. Double click this item and Check the Success parameter. In order to get it to work in Windows 7 you have to enable the “auditing” of events 4800 and 4801.

In Local Group Policy editor go to: Computer Configuration -> Wndows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies – Local Group Policy -> Logon/Logoff. In subcategory (on the right) choose Audit Other Logon/Logoff Events. Double click this item and Check the Success parameter.

]]>