I had a Windows admin challenge the validity of this report because the eventID covers a variety of events that include but are not limited to the machine automatically logging off because the user forgot to. Is there SQL that I am missing that accounts for this? The below info describes the various events that cause event ID 538 and logon type 3 thanks!
b
Interactive logon Event ID 528 Type 2
Interactive logoff Event ID 538 Type 2
Network logon Event ID 528 Type 3
Net Use connection Event ID 528 Type 3
Network logoff Event ID 538 Type 3
Net use disconnection Event ID 538 Type 3
Autodisconnect Event ID 538 Type 3
