Logon Events

What's the difference between the audit account logon events policy and the audit logon events policy? I'm trying to get an understanding of the two because I saw that question on a practice exam and even though I got the right answer, I'm still confused as to the difference between the two.

Thanks in advance!

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

skrpune

Auditing under "audit account log on events" is triggered when a user logs onto a computer using an account that is validated by the computer you've changed the audit settings on, so essentially this would track domain account log ons. Auditing under "audit log on events" would track local account log on to a single computer - on a domain controller this includes domain account log ons, but on non-domain controllers it basically tracks local account log on.

dynamik

Auditing: The difference between audit account logon event and audit logon event.

sainth

Is there a way to check the event log on a year before? I'm trying to find out if a certain user log on to a certain date last year. Hope you can help me. Thanks!

dynamik

Depends on your retention settings/policies. If the events aren't in the log, and you haven't been archiving them, then no.

sainth

Thank you, however, how do you know or where to check the archive of the event log? Sorry, I'm a newbie.

dynamik

sainth wrote: »

Thank you, however, how do you know or where to check the archive of the event log? Sorry, I'm a newbie.

You would have to have been doing this manually or have setup some sort of automated solution.

royal

Short Explanation:

Audit Account Logon = Auth on DC (Kerberos TGT for example)
Audit Logon = Auth on non-DC (Kerberos Service Ticket for example)