Logon Events

Logon events are recorded when someone logs on to the system, regardless of the account used. In other words, if you log on to a domain member using a domain account, you get a logon event recorded on the domain member. You would also get a logon event recorded if you log on with a local account.

Account Logon Events

Account logon events are recorded when someone authenticates using an account defined on this system. In other words, if you log on to a domain member using a domain account, the account logon event gets recorded on the domain controller, not on the client. If you log on to the domain member using a local account, the account logon event gets recorded on the client.

One of the authors once was in a situation of doing forensics on a system that had been hacked by a student in his lab. The student had logged on to the machine, shut it down, set a boot and BIOS password, and changed the system clock. The student had then booted the system to ensure everything worked, logged on again, shut down the system, and then left. The logon events on the system itself were incorrectly ordered due to the system clock change. However, by correlating those events with the account logon events on the domain controller, we were able to determine conclusively both who had performed the attack and when. This information was enough to take action against the student. Thus, logon events can be very useful on clients. Other useful types of events include object access auditing. For any object access events to be recorded, however, you need to first configure system ACLs (SACLs) on objects, because none are configured by default.

We recommend configuring audit settings that are consistent with your security policy and audit needs.