I have a task that is triggered on PC1 whenever the user locks their computer. This works fine.

I just set it up the same on PC2, but the Event ID 4800 is not logged on this machine when the user locks the screen. The only difference I can see between the machines is PC2 is “for Workstations”.

Is there a way to enable logging of 4800 Event ID? I tried using 4634 (Logoff), but for some odd reason it made my task fire all the time? Even though 4634 only showed up in the security log when I locked the computer.

PC1 – Windows 11 Pro, ver 23H2, OS Build 22631.3593

PC2 – Windows 11 Pro for Workstations, ver 23H2, OS build 22631.3593