What's the best approach to receive logs from DC's when user login, logout or type wrong pass ?
Preferably without agent.
Is there a way to get info who, when, and where ?
From the Active Directory Domain controller?
Either use event log monitoring, or use the AppInsight for Active Directory. Both included with SAM and Observability Self-hosted