We currently use UserLock to track logon activity and estimate computer-lab usage. As we move to Intune and Entra ID, we'll be moving away from on-premises Active Directory and do not plan to use a hybrid-joined setup. UserLock appears to work only with devices connected to on-prem AD. Is there an alternative that can audit both logon and logoff events on Entra-joined Windows devices, ideally with enough detail to measure how long lab computers are actually being used?
4 Answers
Be aware that sign-in log retention is limited by default—typically 7 days for the free tier and 30 days with Entra ID P1 or P2. You can configure diagnostic settings to send SignInLogs to Log Analytics or storage for longer retention. However, these are authentication events, not true logoff events or session durations. For accurate lab seat-time reporting, you’d need to collect logoff or session data from each endpoint and send it to a central system.
Entra-joined devices report authentication activity through Entra sign-in logs. You could export those logs and build a custom report showing which user signed in and which device was involved.
Netwrix may be worth investigating; some of its auditing products support Entra and can also monitor local Windows Security event IDs for logon and logoff activity. Another practical option is forwarding Windows event logs with a log collection platform or using PowerShell to gather and centralize the relevant events.
Define the report you actually need before selecting a replacement. Shared lab machines make this complicated because users may lock the screen, switch accounts, or leave without signing out. Intune and Entra sign-in data may provide a defensible record of which user used a device during a time period, but it won’t necessarily provide exact usage duration.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures