2
1
I have found the following information pertaining to when a user starts and stops interacting with a Windows 7 Home Premium 64-bit PC. Theoretically, these events can be viewed in eventvwr.exe
when run as Administrator.
However, I have tried locking and unlocking the workstation and nothing shows up in the log. What must I do to enable this behavior?
Logon Session Events
- 4624 Successful logon
- 4647 User initiated logoff
- 4625 Logon failure (See Logon Failure Codes)
- 4778 Remote desktop session reconnected
- 4779 Remote desktop session disconnected
- 4800 Workstation locked
- 4801 Workstation unlocked
- 4802 Screen saver invoked
- 4803 Screen saver dismissed
UPDATE:
@DavidPostill, I have tried the solution below, downloading and running the file you mentioned, and copying the C:\SysWOW64\gpedit.msc
file to C:\Windows\System32\gpedit.exe
, but I ran into the following problem:
The files C:\SysWOW64\GroupPolicy
and C:\SysWOW64\GroupPolicyUsers
could not be copied to C:\Windows\System32\GroupPolicy
and C:\Windows\System32\GroupPolicyUsers
because these folders already existed.
Here is what I get when I run gpedit.msc
:
Were you logged in as an Adminstrator when you tried to copy the directories? Can you try just copy the contents of
C:\SysWOW64\GroupPolicy
and paste toC:\Windows\System32\GroupPolicy
? NoteC:\SysWOW64\GroupPolicyUser
is an empty directory so that shouldn't be a problem. – DavidPostill – 2015-10-25T20:53:38.593The only other thing I can think of is that you have a non English version of Windows ... (Italian?) – DavidPostill – 2015-10-25T20:54:47.337
Yes, but the filenames should be the same even in my localized Italian version of Windows... ? – Jordan Jamingsons – 2015-10-27T19:52:12.840