SecPol Audit Policy: Diff between "Audit account logon events" and "Audit logon events" ?

[Sebastian Kaist]

When I open secpol.msc and the menu

Local Policy->Audit Policy

then there are two similar entries:

- Audit account logon events

and

- Audit logon events

What is the difference?

Sebastian

 

[WTC]

Sebastian Kaist wrote:

- Audit account logon events
http://technet.microsoft.com/en-us/library/cc787176.aspx


- Audit logon events

http://technet.microsoft.com/en-us/library/cc787567.aspx

 

[thehman]

Audit Logon Events are checkign the Domian Controller. While the account
logon events are checking local workstation.
If you open the properties applet on each setting click the "explian this
setting tab" this tab explians the settings and also compiares the two a
little bit.