Actions and Logon Types Captured When Monitoring Logon Activity

Review a full list of actions captured when monitoring Logon Activity with Netwrix Auditor.

NOTE: For the attributes marked with asterisk (*) what changed is not reported.

Action	Object Type	Attributes
Successful Logon	Logon	—
	Interactive Logon	A session was reconnected.
Failed Logon	Logon*	Cause description. The number of matching events if the logon attempt failed several times during a short period of time.
	Interactive Logon
Logoff	Interactive Logon	A session was disconnected. Session duration (if the corresponding logon was found).