Difference between audit logon and account logon

Can someone explain to me the difference between Audit Account logon events, and Audit logon events. I keep getting these questions wrong in 70-640 practice tests. From what I have read they are the same thing, but I have had either one or the other be the correct answer in Labsim practice exams.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Psoasman

These two are easy to mix up, I had some trouble remembering them, as well.

Account logons are used when you authenticate to a computer. For example, if you log on using your domain account, the DC will have a record of that in it's log. If you were to log on with a local account, then the log record will be reflected in the local computer events.

Logon tracks logon or logoff on the local machine and (I think if you make a network connection - don't quote me on that, it's been a while)

I remembered it as logon = local and account for the DC. I hope this helps.

btw: I used LabSim for the 640 and I remember some of the questions being extremely detailed on this topic.

Commguy23

Thank you sman, did you use any other practice exams to prep? I used transcender for security + and 70-680 and loved it. Im curious if labsim is enough or if I should get transcender also. The labsim questions seem to be extremely long and detailed. It can take me 10 minutes for a single question sometimes.

Psoasman

I also used the MS Press book tests. The LabSim "Facts" are good notes, too. I found with the LabSim, it was easier to just go through the smaller test sections. I remember spending a couple of hours on the longer practice exams.