The Change Auditor for Logon Activity User license enables server agents to generate the following events:
- Authentication activity (interactive, remote interactive and network logons) including successful and failed logons performed on monitored servers
- Domain Controller authentication activity (Kerberos), including successful and failed requests (available for Domain Controller agents only)
- User logon session activity (the actual time spent on a server)
The Change Auditor for Logon Activity Workstation license enables workstation agents to generate the following events:
- Authentication activity (interactive, remote interactive and network logons), including successful and failed logons performed on monitored workstations
- User logon session activity (the actual time spent on a workstation)