Take the 2-minute tour ×

Does Windows XP keep a log of the login and screen locking events? If so, how can I view it?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

Logon events are in the event viewer under Security. I don't think desktop locking is audited.

share|improve this answer
And how would I search for those events? The event viewer logs are rather lengthy. –  Jonathon Watney Sep 16 '09 at 0:16
You can filter the events for what you are searching for. You can do this by opening the event viewer log and right clicking on the log name and choosing "Filter". –  TheCleaner Sep 16 '09 at 0:30
Thanks. I've filtered by login name and I don't see any login events, or events for today even. Any other ideas? –  Jonathon Watney Sep 16 '09 at 0:42
Do you have auditing enabled for logon events? If so, are you auditing both Success and Failure events? –  joeqwerty Sep 16 '09 at 3:06
Be aware that in XP by default auditing is turned off, so you need to start by enabling it. –  John Gardeniers Sep 16 '09 at 5:48

Whether these events ARE audited is another question. I don't recall the defaults. To ensure they are, Go to Control Panel, Administration Tools and run Local Policy Settings. In there under audit policies, there are two different login events listed. Enable success and failure for both.

Then in Computer Manager, right click the Security event log and expand its size to 8MB and set Overwrite as needed (unless you really MUST KNOW, then select do not overwrite). 8MB should give you enough overhead to ensure the events are there when you look.

(WARNING: do not enable successful 'audit object access'. This will generate an event for every file & registry key access and will likely bring it to a crawl.)


share|improve this answer

There may be some more hinst and tips in this question :


share|improve this answer

Your Answer


