Logon/Logoff Events in Local Security Log of Terminal Server

microsoft.public.windows.server.security - Supporting MS Windows network? Read here before it's too late! 

Subject Author Date Logon/Logoff Events in Local Security Log of Terminal Server NW 07-20-2007

Posted by NW on July 20, 2007, 2:39 pm Please log in for more thread options When reviewing some logon times for a user of Terminal Server I notice many logon events are recorded in the TS local security log. But the user in question's logon events seem to only be recorded on the domain controllers, which is what I expect. Audit policy for the domain controllers and terminal servers are at the default settings. Any hints on why this might be? Similar Threads Posted audit logon/logoff events on terminal server July 18, 2007, 10:29 am Sharing a Local Printer in Terminal Server December 5, 2006, 2:50 pm Sharing a Local Printer in Terminal Server December 5, 2006, 2:50 pm Multiple 538 and 540 ID's in 2003 server Security Events Log? August 23, 2006, 12:58 am Auditing Security Events May 10, 2007, 1:54 am Follow-up to Empty 529 Events in Security Log July 27, 2006, 12:02 pm Auditing events for Security Monitoring July 22, 2009, 6:12 am Lots of security events (529 + 680) - hack? March 16, 2010, 5:50 pm Security Log - Events 680, 529 and 675 for NT AUTHORITY\SYSTEM every two minutes February 5, 2006, 11:50 am Overload: 562/565 Security Events (Success Audit) July 16, 2009, 7:14 am