“New” audit Logon/Logoff and other event IDs
When you are searching Logon or Logoff event ID numbers, you may find a lot of old sites talking about ID 528 and ID 538. However, since Windows 7 and Windows Server 2008 R2, these event IDs don’t apply anymore and are completely useless for those more recent operating systems. The Advanced Security Audit Policy […]
