How do you find a search that finds open windows locked-screen sessions?

Path Finder

Trying to figure out a string to find open windows locked-screen sessions

Monitored all security events when doing a log on, full log-off and locked screen
4624 logon (type7 = logon from a locked screen)
4624 logon (type 2 = full logon when no active session running)

4634 = locked screen
4647 = full log off

4673 = privileged service called – this one is interesting, there is a 4673 heart beat on the machine that has a locked screen user session.

Doing the below

Index=winevents EventCode=4624 OR EventCode=4634
| transaction host startswith=EventCode=4624 endswith=EventCode=4634
| table what you want

Problem with the above — it finds the log-on and then locked screen events, but it isn't catching after that event. Then user logged on again, then fully logged out — so you see, every time someone did a log on and locked screen — even if they later logged in yet again and the legit logged off cleaning the situation.

This is where maybe that 4673 event ID is of value?

Tags (1)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!