Locked Workstation Session Event
Detects workstation session lock events that occur automatically after a standard period of inactivity. This event indicates that a user's session has been locked, typically due to inactivity or a manual lock action. While often a security measure, monitoring these events can help identify unusual patterns of workstation locking, which might precede or follow other suspicious activities, or indicate policy compliance issues.
Sigma
