On Wed, Jan 18, 2012 at 4:14 PM, Kurt Buff <[email protected]> wrote: > IIRC, lock/unluck events are recorded locally, not on a DC.
I think you're right, there. The logon/logoff session events would be local. But credential validation would be logged on the DC (subject to all the usual caveats about credential validation, e.g., caching, GP settings impacting caching, audit settings, whether the computer feels like it or not, etc.). -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
