Before you start creating a monitoring plan to audit the logon activity in your domain, plan for the domain account that will be used for data collection – it should meet the requirements listed below. Then you will provide this account in the monitoring plan wizard.
Starting with version 9.96, you can use group Managed Service Accounts (gMSA) as data collecting accounts.
Depending on the network traffic compression setting you need to use, one of the following is required:
- If network traffic compression is enabled, then the account must belong to the Domain Admins group;
If network traffic compression is disabled, then you can choose between account which belongs to the Domain Admins group or non-administrative account. See Configure Non-Administrative Account to Collect Logon Activity for more information.