Step 1 – Open “Group Policy Management” console by running the “gpmc.msc” command.
When a domain controller authenticates a domain user account, events are generated and stored on that domain controller.īelow are the steps to enable auditing of user Logon/Logoff events These events happen on the machine where you log in.Īudit Account Logon Events: This setting generates events on the computer that validates logons. You can do this through two GPO settings:Īudit Logon Events: This setting generates events for starting and ending logon sessions.
Enable Native Auditing of User Logon/Logoff Events