KB10115 - GPO: Enable Advanced Logon Audit

This article describes how to enable advanced logon an logoff audit on Windows operating systems.

---

First of all you have to enforce the subcatogory auditing in the local or domain based GPO:

The next thing is to enable logging of logon events - I prefer when both sucessfull and failed events get logged:

and