Actions and Logon Types Captured When Monitoring Logon Activity

Review a full list of actions captured when monitoring Logon Activity with Netwrix Auditor.

NOTE: For the attributes marked with asterisk (*) what changed is not reported.

Action Object Type Attributes

Successful Logon


Interactive Logon

A session was reconnected.

Failed Logon


Cause description.

The number of matching events if the logon attempt failed several times during a short period of time.

Interactive Logon


Interactive Logon

A session was disconnected.

Session duration (if the corresponding logon was found).