Important Notes (audit policy change on client side)
The windows default log setting does not provide sufficient information for LogonTracer. You must to enable the audit policy on each computer which you want to analyze logon activities.
Open Local Group Policy Editor (gpedit.msc) and drill down to following location.
Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object
Enable following entries, the event ID will be recorded.
- Account Logon
- Audit Credential Validation
- Audit Kerberos Authentication Service
- Audit Kerberos Service Ticket Operations
- Logon/Logoff
- Audit Logon
- Audit Special Logon
