In LEM, we see logon and logoff events but the details do not show us what machine a particular user logged into. We are getting requests to create a report of what machines a user logged into in a particular time range.
Thanks!
Are you doing any logging with the Agents on Workstations? I just setup an alert for someone, and they were seeing destination machine on the logon and logon failure events.
Yes, we are getting inputs from the agents but only on domain controllers. We don't install the agent on workstations.
Can you run this command and see what the result is on your Domain Controllers?
It is all set to No Auditing
Well, there's your problem. You need to modify that and see if you get the info you want.