Unable to log Windows Interactive Logon events in SEM

This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides brief information and steps to resolve the issue when you are unable to find any interactive Logon events for your Windows host. 

Other UserLogon events are visible, but not interactive Logon. 

Interactive logon events only exist on the computer that recorded the logon, typically just your PC/laptop. The same would apply to logging into any Windows server. Windows logs on a domain controller do not include the interactive logon events, unless you are logging directly into the domain controller (at the keyboard or RDP session). The domain controller acknowledges a "network" login from a users PC/laptop or server.

In order to log Interactive Logon events from your workstations, you must meet the following conditions:

• The SEM Agent is installed on the workstations and servers you want to monitor, not just the domain controller(s).
• The group policy applied to your workstations (most likely the Default Domain Policy) is configured to monitor user logon events.

If the above conditions are true, you should be able to locate Interactive Logon events in nDepth by searching for the following conditions:

UserLogon.LogonType = Windows: Interactive

OR

User.LogonType = Windows: Remote Interactive Logon

For additional information, see Audit logon events from the Microsoft website.