question

Young Fred

when it comes to auditing it's not as easy as you would think here's my question?
if you want to audit a local computer's logging on/off do you select account logon or logon?
note: one is for auditing local computer logging on/off and one is for network logging on/off

sprkymrk

The Audit logon events category is used when a user logs on interactively (right there at the keyboard/monitor)) or remotely (from across the network).

You can tell by the user name and domain field if the account was local or domain, and you can tell by the "logon type" field whether it was interactive (2), network (3), batch (4), service (5), unlocked workstation (7), etc.