[DOZ1T]

I believe someone may be trying to get into my computer at work, it's my personal laptop (that I use for work) so I have encrypted BIOS/HDD as well as a Windows login password. I've been locking my computer everytime I go buy coffee or smoke a cigarette and I want to avoid looking suspicious by doing so. Is it possible to create a windows script (Batch, shell etc.) that I can execute once I go AFK and if the mouse or keyboard is pressed or moved in the slighest it will automatically lock the computer (to the Windows login screen).

[Joseph Ducreux]

cmd has very horrible OS catching abilities because its not meant to do that. its only meant to be ran within CMD and not out of CMD and thus catching events that happen outside of CMD like keypresses or any other activity is not gonna possable / easy... you can easily lock windows from CMD via the code below, but catching any OS activity is gonna need higher level languages such as c++/delphi i think even autoit has limited ability but all autoit programs even legitimate non virus ones usually trigger AVs 99% of time :

Code

@echo off
rundll32.exe user32.dll, LockWorkStation
pause>nul

---

why dont you just check the system event log to detect when people are logging in? you clock out for break you rerember what time you clocked out and clocked back in and if any logins were detected in that period you than know that youve been fucked. Also what are we to assume that, that is the only way they are getting in? how do you not know their not using a RAT tool or something? closed network enviromnts with their own DNS configuration its very easy to get network wide tools installed on new devices to make them safe for the network (redirects new devices to a portal to download mandatory security tools) theirs way to many factors but your implimentation of trying to stop it is bad... in my opinion lol

[DOZ1T]

cmd has very horrible OS catching abilities because its not meant to do that. its only meant to be ran within CMD and not out of CMD and thus catching events that happen outside of CMD like keypresses or any other activity is not gonna possable / easy... you can easily lock windows from CMD via the code below, but catching any OS activity is gonna need higher level languages such as c++/delphi i think even autoit has limited ability but all autoit programs even legitimate non virus ones usually trigger AVs 99% of time :

Code

@echo off
rundll32.exe user32.dll, LockWorkStation
pause>nul

---

why dont you just check the system event log to detect when people are logging in? you clock out for break you rerember what time you clocked out and clocked back in and if any logins were detected in that period you than know that youve been fucked. Also what are we to assume that, that is the only way they are getting in? how do you not know their not using a RAT tool or something? closed network enviromnts with their own DNS configuration its very easy to get network wide tools installed on new devices to make them safe for the network (redirects new devices to a portal to download mandatory security tools)  theirs way to many factors but your implimentation of trying to stop it is bad... in my opinion lol

Right I'll look into detecting the event in some other and running that function in the CMD when it fires, thanks!