Reporting

Policies reports provide detailed logs of Multi-Factor Authentication (MFA) events and logon attempts denied by access policies. They help administrators monitor access control and identify potential security risks.

The following reports are included:

• MFA events: all MFA attempts (success, failure, skipped, cancelled, help requests).

• Denied logons: failed or denied logon attempts, whether blocked by Active Directory (e.g., bad password) or by UserLock access policies (e.g., unauthorized machine, hours, quota, geolocation, group limits).

History reports provide a detailed timeline of user activity and session events across the network.

The following reports are included:

• Events timeline: all session events in chronological order.

• Session history: complete log of user sessions (open, closed, incomplete).

• Simultaneous sessions: domain users with overlapping sessions.

• Single Sign-On events: SSO activity by user or application.

• Wi-Fi / VPN sessions: network sessions by connection type (with RADIUS if configured).

• IIS sessions: web application activity by pool or application name.

• UAC events: granted or denied privilege escalation requests.

• User status changes: transitions between statuses (e.g., risky).

Working hours reports summarize user activity over time, including daily, weekly, and monthly breakdowns. They highlight when users are active, inactive, or connected outside authorized hours.

The following reports are included:

• History: daily overview of hours worked.

• Statistics by user: one row per user for the selected period, with average first logon and last logoff times, and total session, active, and locked times. Expand a row to see the user's details day by day.

• Statistics by date: one row per day, with the same statistics across all users. Expand a row to see each user's details for that day.

• Week / Month: aggregated activity for a period, per user.

• Unauthorized: activity outside authorized working hours.

Administration reports provide audit logs of administrator actions and configuration changes.
They ensure accountability and support compliance requirements.

The following reports are included:

• Actions: log of administrator operations such as agent installations, machine reboots, user MFA resets, or session terminations.

• Configurations: changes to access policies, MFA settings, user blocks/unblocks, or server settings/updates.

By default, reports are generated from the production database. Each administrator can also add archived databases, such as a former database kept after a database migration or a yearly archive, and generate reports from them. Archived databases are used only for reporting.

Archived databases are specific to the administrator who adds them and are not shared with other administrators. The database selected for reports is saved locally by the console, not on the UserLock server.

The database selector is located on each report page, to the left of the Schedule and Export buttons. Production is always listed first and selected by default.

Each source in the selector, including production, shows a status indicator:

The following rules apply to archived databases:

• The database must already exist: the database wizard cannot create one.

• The database must contain UserLock data. A database without UserLock tables is rejected.

• Databases created with earlier versions of UserLock can be added.

• The production database cannot be added as an archived database, even with a different account.

• Each archived database in your list must have a unique name, and the same database cannot be added twice.

• Passwords are encrypted on the server and are never sent back to the console.

To add, manage, or troubleshoot an archived database, see Generate reports from an archived database.

Every report in UserLock supports flexible customization to fit your monitoring needs:

All reports can be exported in PDF, Excel (XLSX), or CSV formats.

Reports can be scheduled for automatic delivery or archival.
Schedules are based on saved report views, and define:

• Frequency: daily, weekly, or monthly, with time and time zone settings.

  

• Reports included: one or more reports, each with a time range and selected view.

  

• Actions:

  • File format: PDF (20,000 rows max.), XLSX or CSV (1 million rows max.).

  • Send by email: define recipients, subject, and body options. Ensure your email settings are correctly configured.

  • Archive: save the files to a folder on the server. The Archive mode defines whether each file uses Overwrite the previous file or Add the datetime in the name. The second option keeps one file per run but uses more disk space on the server.

  Both actions can be selected for the same schedule.

  

• All schedules are listed on the Scheduled reports page, where they can be edited, deactivated, or deleted. From the list, a View link opens the exact report with its filters and settings.

  

Each console has its own scheduler: schedules created in the Windows Console are not visible in the Web Console, and the reverse.

Each schedule stores the display language of the console used to save it. When the schedule runs, the report files (PDF, XLSX, CSV) and the notification email are generated in that language.

To generate reports in a specific language, switch the console to that language before you save the schedule. The stored language is not displayed in the scheduling wizard or in its summary.