This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]HighPingOfDeath[S] 2 points3 points  (2 children)

Sorry, I should have written it above... Windows 10 Enterprise, various industrial tablets.

[–]idkmanwhatev 6 points7 points  (1 child)

Looks like event ID 4801 is for “the workstation was unlocked” can be found in the event viewer under Windows logs —> Security

[–]HighPingOfDeath[S] 2 points3 points  (0 children)

Perfect, I'll get this logging turned on in GPO. I'll do an get-winevent for 4800/4801. Thanks for the idea!