The Change Auditor Logon Activity auditing module, handles the auditing of Logon events. The Change Auditor Logon Activity auditing module is enabled by one of two licenses allowing you to collect this important logon and logoff activity:
- The Change Auditor for Logon Activity User license enables server agents to generate the following events:
- Authentication activity (interactive, remote interactive and network logons) including successful and failed logons performed on monitored servers
- Domain Controller authentication activity (Kerberos), including successful and failed requests (available for Domain Controller agents only)
- User logon session activity (the actual time spent on a server)
- The Change Auditor for Logon Activity Workstation license enables workstation agents to generate the following events:
- Authentication activity (interactive, remote interactive and network logons), including successful and failed logons performed on monitored workstations
- User logon session activity (the actual time spent on a workstation)
Logon activity auditing for servers is only available if you have applied the Change Auditor for Logon Activity User license. Logon activity auditing for workstations require the Change Auditor for Logon Activity Workstation license and workstation agents to be deployed to the workstations to be monitored.
See the Change Auditor Installation Guide for more information on deploying workstation agents.