Pls tell me the exact difference between "Audit Account Logon Events" and "Audit Logon Events"

[Spin]

Gurus,

Regarding auditing of domain logins by my network users, I am unclear of the
advantages of auditing for "Audit Account Logon Events" versus straight-up
"Audit Logon Events". These seem to me to be one and the same.

[Nina Harris]

Spin wrote

> auditing for "Audit Account Logon Events" versus straight-up
> "Audit Logon Events". These seem to me to be one and the same.

here's the definition from latest msdn

Description
Determines whether to audit each instance of a user logging on, logging off,
or making a network connection to this computer.

If you are auditing successful Audit account logon events on a domain
controller, then workstation logons do not generate logon audits. Only
interactive and network logons to the domain controller itself generate
logon events. In short, "account logon events" are generated where the
account lives. "Logon events" are generated where the logon occurs.

By default, this value is set to No auditing in the Default Domain
Controller Group Policy object (GPO) and in the local policies of
workstations and servers.

If you define this policy setting, you can specify whether to audit
successes, audit failures, or not to audit the event type at all. Success
audits generate an audit entry when logon occurs successfully. Failure
audits generate an audit entry when an attempted occurrence of the logon
fails. You can select No auditing by defining the policy setting and
unchecking Success and Failure.

[Spin]

Thanks!!!!!!!!

"Nina Harris" <sas@mailinator.com> wrote in message
news:2k9cilF17lm5uU1@uni-berlin.de...

> Spin wrote

> > auditing for "Audit Account Logon Events" versus straight-up
> > "Audit Logon Events". These seem to me to be one and the same.

>
> here's the definition from latest msdn
>
> Description
> Determines whether to audit each instance of a user logging on, logging

off,

> or making a network connection to this computer.
>
> If you are auditing successful Audit account logon events on a domain
> controller, then workstation logons do not generate logon audits. Only
> interactive and network logons to the domain controller itself generate
> logon events. In short, "account logon events" are generated where the
> account lives. "Logon events" are generated where the logon occurs.
>
> By default, this value is set to No auditing in the Default Domain
> Controller Group Policy object (GPO) and in the local policies of
> workstations and servers.
>
> If you define this policy setting, you can specify whether to audit
> successes, audit failures, or not to audit the event type at all. Success
> audits generate an audit entry when logon occurs successfully. Failure
> audits generate an audit entry when an attempted occurrence of the logon
> fails. You can select No auditing by defining the policy setting and
> unchecking Success and Failure.
>
>