When I try to login interactively on windows 8 workstation using local SAM account, I don't see any account logon category events on security log of event viewer. All I can see only logon category events. So how do I track authentication events caused by local SAM account while interactive logon to local workstation?
Under what scenarios and situations, account logon events are logged on local workstation? What are Event IDs of these account logon events?