> Resources > WinSecWiki

To log these events you must either enable this entire Account Logon category using the Audit account logon events policy or you can enable any of the subcategories below using the auditpol command. Edit

Subcategories

• Credential Validation
• Kerberos Authentication Service
• Kerberos Service Ticket Operations
• Other Account Logon Events

About this category

Following is an excerpt from: The Windows Server 2003 Security Log Revealed.

Microsoft should have named this category Authentication instead of Account Logon to reduce confusion between it and the Logon/Logoff category. On DCs, these events allow you to track all attempts to log on with a domain user account, regardless of where the attempt originates. On a workstation or member server, these events document any attempts to log on by using a local account stored in that computer’s SAM.