Skip to main content


How to do Logon Session Auditing with the Windows Security Log

Air Date: March 8, 2018 at 9:00 am PT

SpeakerAndy SkreiSolutions ArchitectExabeam

Logon session auditing can be tricky.

The Good News: The data is in the security log.

The Bad News: The actual events denoting the beginning and end of a logon session are not in the domain controller log.

Join us for this technical webinar with Ultimate Windows Security where we’ll discuss two ways to track logon sessions and how a UEBA solution can help make sense of this complex data:

  1. Workstation Logs: Less complicated, but more log collection heavy.
  2. Domain Controller Logs: More sophisticated analysis capabilities, but less log management needs.