How to configure a search for users who were granted interactive logon rights to a server. (4318190)

Please complete the following steps:

1. Open the Change Auditor Client and select the “Search” tab
2. Click “New” in the Button Bar menu, enter the desired name in the Search Name” field at the lower section (Info tab).
3. Select the “What” tab click the “Add” button in the properties menu
4. Search for and select “DACL Changed on user object” 
5. Check the "Where the" option in the "Restriction" section of the Event Class and select "Operation" for the drop-down list.
6. Select "Permission Added" from the "Value contains" drop-down list.
7. Check the next  "Where the" option and select "Permission" for the drop-down list.
8. Select "Interactive" from the "Value contains" drop down list.
9. Click “Add” to move the selection to the lower section and click “Ok".