Dear community, i would like to have your opinion and help in order to create reports for user activity on windows such as log-in and log-out. Based on windows Logon events and Logon type it seems kind of frustrating and it appears like the numbers of log in for one specific user are two high comparing to the real situations. I have tried query like this:
"This event records every successful attempt to log on to the local computer. It includes critical information about the logon type (e.g. interactive, batch, network, or service), SID, username, network information, and more. Monitoring this particular event is crucial as the information regarding logon type is not found in DCs."