UserLock Documentation
UserLock Documentation
You are here: Reference > Advanced > Database Reference

Database Reference

The UserLock database is composed of two tables:

You can find below a list of the fields including in these tables, showing their type and their purpose.

Please note: The UserLock database is in free access to benefit from all data generated and collected by UserLock. However we strongly recommend that neither the database architecture nor content information be modified.

UserLogonEvents table

Field name

Data type

Field description

EventType

integer

Interactive sessions
0 logoff / 1 logon / 2 lock / 3 unlock / 4 logon denied by UserLock/ 5 reconnect / 6 disconnect
20: Interactive logon denied by Active Directory
420: RDP/terminal logon denied by Active Directory (See 'LogonInfo' for details)

Wi-Fi / VPN sessions
200 logoff / 201 logon / 204 logon denied by UserLock
220 logon denied by Active Directory(See 'LogonInfo' for details)

IIS sessions
100 logoff / 101 logon / 104 logon denied by UserLock
120: logon denied by Active Directory(See 'LogonInfo' for details)

EventTime

date time

Date and time of the logon/logoff event

UserAccount

string

User account name

UserDomain

string

User domain

UserFullName

string

User full name

ComputerName

string

Logged on workstation or terminal server

ComputerSession

integer

0 local console / >1 for terminal sessions

ClientName

string

Logged on workstation or terminal

ClientAddress

string

Workstation or terminal IP address

SessionId

string

Session identifier

SubSessionId

integer

Sub session identifier. Increased by 1 after each unlock event (new sub session)

Status

integer

If not null the event was not notified in realtime by the agent

ErrorId

string

Information to send to the support team if needed

LastError

integer

Information to send to the support team if needed

Param1 to Param6

string

Dynamic fields used by Wi-fi/VPN/IIS logon/logoff events

Id

integer

Record id (auto)

LogonInfo

integer

The meaning of this value depends on the value of the associated 'EventType' value.

Detailed reasons for Logon denied by UserLock, when associated 'EventType' = 4, 104 or 204
1: Group restriction
2: Workstation restriction
4: Time restriction
8: Time Quota restriction
16: Session restriction
32: Initial Access Point restriction
64: The user account is blocked by UserLock

Logon denied by UserLock can be caused by several reasons. Therefore the value recorded for logon denied by UserLock is a cumulative value. For example, 25 means that group, user and time quota restrictions were applied (1+16+8).

Detailed reasons for Logon Denied by Active Directory, when associated 'EventType' 20, 220 or 420:
0: Unknown
1: Invalid user
2: Invalid password
4: Account locked out
8: Domain controller and workstation clocks are skewed
16: Password must be changed before login
32: Active Directory restriction
64: Account restriction
128: ​​Logon hours restriction
256: Account disabled
512: Workstation restriction
1024: Account expired
2048: ​Password expired

As logons denied by Active Directory have an exclusive reason, only a single value from this list will be stored.

Detailed reason for Logon Denied by Active Directory, when associated 'EventType' 120:
2: Invalid password

SessionType

integer

Reserved for future use

ServerAddress

string

The IP address of the computer where the session event occurred.

TimeZoneShift

integer

Time difference with UTC (Coordinated Universal Time), in minutes.

UserStatus table

Field name

Data type

Field description

Id

integer

Record id (auto)

Status

integer

​Current status of the user:
0: Normal unprotected
1: Normal protected
2: Inactive
3: New user
4: Suspicious behavior
5: Bad behavior

Triggers

integer

​Flags of remarkable conditions to help deduce the current status for the user.
Values in hexadecimal:
0x00000001: Protected
0x00000002: First event
0x00000004: Event
0x00000008: Event after period
0x00000010: Inactivity
0x00000020: Access denied because account is locked by Active Directory
0x00000040: Sessions over limit
0x00000080: Sessions over a figure
0x00000100: Access denied by UserLock
0: Access denied by Active Directory

OldStatus

integer

Previous status of the user:
0: Normal unprotected
1: Normal protected
2: Inactive
3: New user
4: Suspicious behavior
5: Bad behavior

OldTriggers

integer

Flags of remarkable conditions to help deduce the previous status for the user.
Values in hexadecimal:
0x00000001: Protected
0x00000002: First event
0x00000004: Event
0x00000008: Event after period
0x00000010: Inactivity
0x00000020: Access denied because account is locked by Active Directory
0x00000040: Sessions over limit
0x00000080: Sessions over a figure
0x00000100: Access denied by UserLock
0: Access denied by Active Directory

UserAccount

string

User account name

UserDomain

string

User domain

UserFullName

string

User full name

SessionId

string

Session identifier

SubSessionId

string

Sub session identifier. Increased by 1 after each unlock event (new subsession)

EventType

integer

Interactive sessions
0 logoff / 1 logon / 2 lock / 3 unlock / 4 logon denied by UserLock/ 5 reconnection / 6 disconnection
The following events have been added for connections denied by Active Directory:
10 Invalid password/11 account restrictions/12 account locked out
Wi-Fi / VPN sessions

200 logoff / 201 logon / 204 logon denied
IIS sessions

100 logoff / 101 logon / 104 logon denied