We can enable "User LastLogon Changed" event class in change auditor through following steps:
1. Go to View - Administration - Auditing and under Audit Events, type "User LastLogon Changed" and enable this event class.
2. Go to each DC and set value of "AuditLogonAttribute" registry key to 1.
3. Restart CA agent service on each DC.
4. You will get events in ChangeAuditor.
Note : This event class generates massive traffic in CA environment and you may see DB growth rapidly.Also you may see "Too many SQL events.." warning in Logs which may make other events standing in queue and you will not be able to see these events in Change Auditor. So please consult twice before enabling this events class.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center