So in converting all our users from Orion logins to Active Directory logins I came up with something I don't see in the Audit Events log. That is failed attempts and failed attempts with an unauthorized login. The first is needed to analyze login problems with legitimate logins. The second one is need to be able to detect hack attempts
