How to setup the Active Administrator Workstation Logon Feature
说明
This feature is an agent based solution which will install an agent on each workstation to be audited for user logon and logoff events including lock and unlock. In order for this feature to function, the agent must be instructed on where to send the data from the audit activity and the port on which to send the data to the Active Administrator server. This is performed with an ADMX template which will be incorporated into a GPO. In Windows 2008 and newer, the methods in which GPOs are propagated requires a little more work than in previous versions of the OS.