Are logon/logoff events from computers in the domain forwarded to domain controllers?

Ioann 61 Reputation points
2021-11-10T14:07:30.787+00:00

If a user logs on or off a computer that has joined a domain , we can see in the security logs of the computer that a logon or logoff event has been generated.
Do these events get forwarded to Domain Controllers of the domain that the computer belongs to ?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,698 questions
0 comments No comments
{count} votes

Accepted answer
  1. Anonymous
    2021-11-10T14:12:19.87+00:00

    No, they wouldn't be captured on domain controller.
    This subcategory typically generates huge amount of “4634(S): An account was logged off.” events, which typically have little security relevance.
    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logoff

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.