SecPol Audit Policy: Diff between "Audit account logon events" and "Audit logon events" ?

SecPol Audit Policy: Diff between "Audit account logon events" and "Audit logon events" ?

Post by wizz » Sat, 14 Mar 2009 16:06:35


When I open secpol.msc and the menu

Local Policy->Audit Policy

then there are two similar entries:

- Audit account logon events

and

- Audit logon events

What is the difference?

Sebastian
 
 
 


SecPol Audit Policy: Diff between "Audit account logon events" and "Audit logon events" ?

Post by thehma » Sun, 15 Mar 2009 00:37:25

Audit Logon Events are checkign the Domian Controller. While the account
logon events are checking local workstation.
If you open the properties applet on each setting click the "explian this
setting tab" this tab explians the settings and also compiares the two a
little bit.