Can Change Auditor capture Log-on and Log-off events? (4237836)

Change Auditor can capture Logon information from servers if the Change Auditor for Logon Activity User license has been applied to the Coordinator and CA Agents deployed to the server.

Change Auditor can capture Logon information from Workstations if the Change Auditor for Logon Activity Workstation license has been applied to the Coordinator and the Workstation agents deployed to the workstations.

For more information see the Change Auditor for Logon Activity User Guide found in the Technical Documents section of the Support Portal here.