Group: microsoft.public.windowsxp.security_admin
From: =?Utf-8?B?RnJhbmsgSS4=?=
Date: Tuesday, October 30, 2007 5:42 AM
Subject: Determine when a Windows XP user account has been disabled

Hi all,

I have the following question regarding Windows XP:

Is it possible to determine the date (and evtl. time) when a user account
has been disabled/locked?

The account is a local user account and the machine is not part of a domain.
It is Windows XP Pro with SP2 and the latest hotfixes applied and the
auditing of "account modification" is disabled (as it is by default in
Windows). Only logon/logoff is being audited.

Is there any way to get this information?

Thanks for every help or suggestion.
Frank