How to make an XML filter of the Windows log event on login/logout and lock/unlock the computer by the user?

Question

Windows

Good afternoon, there is a task with group policies to roll 4 tasks onto computers, users on the network.
The essence of these tasks is the launch of a specific vb script for 4 types of events:

1. Logging into the computer under an account
2. Logging out of the computer
3. Locking the computer (Win + L)
4. Unlocking

Moreover, it is necessary to do such tasks so that they can be rolled onto Windows 7 and Windows 10

It is confusing that different types of event IDs are written on the Internet, which one should be based on? It seems that if you use 4624 , then under this ID, not only the entrance, but also the launch of applications on behalf of the computer, etc. Ie. under one ID, many possible actions by the user

Answer 1

1. Login to the computer under an account
2. Log out from the computer

There is no problem at all, logon and logoff scripts are available out of the box. (only in 8.1 and most likely in 10 the default is to delay the execution of logon scripts, but it can be removed.)
By blocking and unblocking:
https://fooobar.com/questions/132997/eventviewer-e... Have you tried it
?