Young FredYoung Fred Member Posts: 80 ■■□□□□□□□□
when it comes to auditing it's not as easy as you would think here's my question?
if you want to audit a local computer's logging on/off do you select account logon or logon?
note: one is for auditing local computer logging on/off and one is for network logging on/off


  • sprkymrksprkymrk Member Posts: 4,884 ■■■□□□□□□□
    The Audit logon events category is used when a user logs on interactively (right there at the keyboard/monitor)) or remotely (from across the network).

    You can tell by the user name and domain field if the account was local or domain, and you can tell by the "logon type" field whether it was interactive (2), network (3), batch (4), service (5), unlocked workstation (7), etc.
    All things are possible, only believe.
Sign In or Register to comment.