I need to audit a user to verify when they are logging on to their computer in the morning. I have a program that monitors the Event Logs and will notify me when certain criteria are met.
I am trying to decipher what is considered a log on and I have been unable to successfully search the internet and get a cut and clear answer.
I believe I am going to be looking at either Event ID 538 or 540, but when I have been doing test logons. The Event viewer is flooded with those. How would I distinguish what is an actual login.
I am trying to decipher what is considered a log on and I have been unable to successfully search the internet and get a cut and clear answer.
I believe I am going to be looking at either Event ID 538 or 540, but when I have been doing test logons. The Event viewer is flooded with those. How would I distinguish what is an actual login.