Windows 10: Audit Lock/Unlock events

I know how to enable advanced auditing for other logon-logoff events in order to catch lock/unlocking of a Windows computer. See link for reference:


https://docs.microsoft.com/en-us/pr...-and-2012/dn311470v=ws.11?redirectedfrom=MSDN


However, I need to enable this through the registry instead of Group Policy or Local Policy. What Registry values do I need to change to enable these security audits?

:)

 

Q about audit logs

When setting up audit logging under Computer Configuration -> Windows Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> Audit Account Lockout, if I enable the Success option, how does this log get triggered? When
an account is locked out, a failure event is fired under the Account Locked category. But when an account is unlocked, an event is fired under the User Account Management category. How would a successful account lockout event get fired? What would that even
be?

 

Windows 10: Scheduled tasks with workstation lock/unlock not being triggered

I solved this by bypassing the "On Workstation Lock/Unlock" trigger types, and setting triggers to look at the windows event log directly.

It's not ideal, but should be sustainable. Definitely still curious about why the triggers provided by Task Scheduler aren't working though.

Configure Lock/Unlock Events

By default, the lock/unlock events are not audited to the event log, you will need to enable logging of these events. You can do so from the group policy editor:

and configuring the following category:

(In the Explain tab it says "... allows you to audit ... Locking and unlocking a workstation".)

Credit: https://stackoverflow.com/a/15904838/1216896

Create Triggers

From there, you can set up triggers to the 4800 (lock) and 4801 (unlock) events like so:

 

Unlocker programs

It's always great to have multiple tools in your toolkit, hence why it is a toolkit.

I prefer to use UnlockIT because it has a more advanced GUI that allows me to view all the .dll's and process hooks in the locked files.

It also has more features that can be seen here: Feature List - UnLock IT
The best of the best in my opinion, however, I would have both in my toolkit in the event UnlockIT cannot do the job for some strange reason (which it has not given any problems).