Event Details
User Activity->Logons->Superior logon/logoff events->EventID 104 - User session was started by computer unlock.
EventID 104 - User session was started by computer unlock.
 Sample:

                                
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust User Session Tracking
Filtering Field Equals to Value
EventId 104
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime
Who Account or user name under which the activity occured. InsertionString1
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "User Session Was Started by Computer Unlock" User Session Was Started by Computer Unlock
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. Source Workstation
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain InsertionString2
WhereDomain -
Result Successful or Failed. - Successful
Comments
You must be logged in to comment