No matching documentation found
Monitored Events & Triggers
Login AlertX monitors the core Windows Event Subsystem to detect physical and remote access to your machine. It is important to understand exactly which actions trigger an alert, and when those alerts are dispatched.
Event Deduplication & Noise Reduction
Before exploring the event types below, note that Login AlertX utilizes built-in noise reduction:
- Logon vs. Unlock Suppression: If you start your PC (triggering a `Logon`) and immediately type your password to enter the desktop, Windows fires both a `Login` and a `Screen Unlock` within milliseconds. Login AlertX intelligently suppresses the `Unlock` event so you only get ONE alert per physical session.
- Rapid Event Throttling: Identical system events occurring within 10 seconds are deduplicated.
Understanding the Differences: Login vs. Unlock
Windows authentication can sometimes be confusing. Here is exactly how Login AlertX separates these events:
- Login vs First Login: A standard Login triggers any time Windows starts a user session (like switching users). A First Login only triggers when starting a session from a completely logged-off state (like the first cold boot of the day). If you only want to know when the PC is turned on and accessed for the first time, use First Login.
- Screen Unlock vs Login via Lock: A Screen Unlock triggers when waking the PC from a simple screensaver or display-off standby. Login via Lock ONLY triggers if the user purposefully secured the workstation beforehand (e.g., by pressing
Windows Key + L). A breach of a manual “Lock” is a much higher security risk.
List of Triggers (UI Toggles)
You can individually toggle any of these events ON or OFF from the Notify Me For panel in the LoginAlertX Dashboard (located under Notification Preferences). Below are the exact categories and toggles you will find in the app:
1. Logins & Authentication
| UI Toggle Name | What it means & When it triggers | Tier |
|---|---|---|
| Login (Session Logon) |
Triggers every time someone officially logs into a user account (e.g., from a cold boot or after switching users). This is the primary entry point to your desktop. | Free |
| First Login (First Time Login) |
Triggers the very first time someone logs into a user account for the day. | Free |
| Failed Login (Failed Logon) |
Triggers when an incorrect password or PIN is submitted at the Windows lock screen or sign-in screen. Crucial for detecting snoopers.
📷 Note on Webcam Capture: Photo capture is supported when the wrong password is entered at the lock screen (i.e., the screen you see after pressing Windows Key + L). It is not supported at the initial Windows login screen that appears when the PC first boots up, as the user session is not yet active at that point.
|
Premium |
| Brute Force | Triggers when multiple rapid Failed Login attempts happen consecutively within a short time window. Alerts you that someone is actively trying to guess your password. | Premium |
| Login via Lock (Lock Login) |
Triggers when a user intentionally logs in back into their active desktop after the screen was previously locked. | Premium |
2. Sessions & Remote Access
| UI Toggle Name | What it means & When it triggers | Tier |
|---|---|---|
| Screen Lock (Session Lock) |
Triggers when a user account screen is manually locked (e.g., Windows Key + L). |
Premium |
| Screen Unlock (Session Unlock) |
Triggers when the computer wakes from a screen saver or locked state, and the user successfully inputs their password/PIN to return to an active session. | Premium |
| Logoff (Session Logoff) |
Triggers when a user completely logs out of their Windows account. | Premium |
| RDP Connect | Triggers when a remote connection to this computer is successfully established over the network via Remote Desktop Protocol.
ℹ️ Requirement: Remote Desktop must be enabled on this PC for this event to fire. If you’ve never set up Remote Desktop, this event will simply never trigger — it doesn’t need to be disabled separately. |
Premium |
| RDP Disconnect | Triggers when an active Remote Desktop connection is ended or the connection is lost. | Premium |
3. Power & System
| UI Toggle Name | What it means & When it triggers | Tier |
|---|---|---|
| Powered On (System Start) |
Triggers when the computer is powered on and finishes starting up. You’ll get an alert as soon as Windows is ready—so you always know when your machine comes online. | Premium |
| Shut Down (System Shutdown) |
Triggers when a user manually shuts down or restarts the computer via the user interface. | Premium |
| Sleep (System Sleep) |
Triggers exactly when the computer is instructed to enter a low-power sleep state. | Premium |
| Hibernated (System Hibernate) |
Triggers when the computer writes memory to the hard drive and completely powers off into hibernation mode. | Premium |
| Resumed (System Resume) |
Triggers the moment hardware components power back on and wake from sleep or hibernation, arriving at the Windows lock screen. | Premium |
| Sleep Login | Triggers when a user actively types their password and unlocks the machine after it was previously asleep or hibernating. | Premium |
| Unexpected Reboot | Triggers retroactively when the system boots up and detects that the previous shutdown was dirty (e.g., a power cable was pulled, or the system crashed). | Premium |
⚡ Instant Dispatch (No Media)
To guarantee that alerts for “Away” events (like locking, sleeping, or shutting down) leave your machine before Windows freezes your network adapter, Login AlertX intelligently bypasses the 10-second camera and audio delays. Events like Screen Lock, System Sleep, System Hibernate, and System Shutdown are text-only and dispatch instantly.