how frequently does a windows domain controller authenticate a windows client while on lan in any typical domain

Question

In a local area network while the user logs on to the domain, will there be a log for the client showing that it had attempted to log on to the domain or it will log the client from the client cache without even connecting the domain controller?

If the user's laptop was already logged in and he then connects to the network, will there be any logs showing any login attempts while rentering the password when his computer gets locked?

Is there a process initiated by the client or the DC and any frequency while on a local area network where it periodically checks and sees if a client /member is connected and logged in and what is that event log on the DC?

Have seen when a user's password is about to expire even if he had previously logged in from home while not connected to LAN and now when he comes to the office and connects to the network it attempts to tell him that his windows password has to be changed mandatorily without which it can't log in. So there is some kind of checks which is done via the domain controller while the user is on LAN on a daily basis.

Answer 1

If a user comes already logged on and connects to the LAN cable of the office network,

Assuming you setup the auditing, in this case I'd look for the 4624 with CachedInteractive

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

You'll probably only see an event at logon. You can setup auditing here.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

Credentials Processes in Windows Authentication

--please don't forget to upvote and Accept as answer if the reply is helpful--