I was asked to find some activities out of working hours on the company workstations.
While srarching for events, i didn't really managed to find the actual interactive login attempt, i was looking for logon types like '2', '7' and '10' but all those looks like a 'krbtgt' processes.
Can anyone please direct me to the actual log that points on the interactive login? Or even to show me from the logs that you have how its looks like. I want to be sure that i'll show the correct log to the managers.
Thanks in advance,