question
Young Fred
Member Posts: 80 ■■□□□□□□□□
in MCDST
when it comes to auditing it's not as easy as you would think here's my question?
if you want to audit a local computer's logging on/off do you select account logon or logon?
note: one is for auditing local computer logging on/off and one is for network logging on/off
if you want to audit a local computer's logging on/off do you select account logon or logon?
note: one is for auditing local computer logging on/off and one is for network logging on/off
Comments
-
sprkymrk
Member Posts: 4,884 ■■■□□□□□□□
The Audit logon events category is used when a user logs on interactively (right there at the keyboard/monitor)) or remotely (from across the network).
You can tell by the user name and domain field if the account was local or domain, and you can tell by the "logon type" field whether it was interactive (2), network (3), batch (4), service (5), unlocked workstation (7), etc.All things are possible, only believe.