Hi, to the best of my knowledge the logon events for any server are logged in the event viewer only on the it's perspective DC.
I want to be able to see logon events that are generated from a local user (not a domain user) and I want to be able to view those events locally on the server (not on the DC).
reason for that is because currently that server is isolated from the network (DMZ).
anyone knows if those events are recorded somewhere in the local server event viewer? (if so, how do I filter them? what event number are they?) and if not, what do I have to do in order for them to be recorded locally? (turn on audit somewhere? etc.)
thank you!
Gil.