InstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 11:57:12 GMT20http://forum.ultimatewindowssecurity.com/Topic258-32-1.aspxWhat does logon type 7 signify for event ID 538 as compared to logon type 7 for event ID 528?Fri, 06 Nov 2009 18:36:42 GMTmark saleshttp://forum.ultimatewindowssecurity.com/Topic130-32-1.aspxHello,<br><br>What would be the best practice in trtrulyapturing the logon's/logoff's of a physical being. Withover 50 to 100 of these type event codes 538's, 528's and 540's it's hard determining what is what in our logs, so it's difficult to say when the user actually "[u]physically[/u]" logging on or off of their machine. What would be the the best practice to interpret these entries if doing an audit on a user? Should we also obtain their SecEvent.EVT file from their local system as well? Thanks for you help.Tue, 07 Jul 2009 15:37:21 GMTitsmevic