Tracking Access Analyzer Console Logons

Question

Does Netwrix Access Analyzer track console logons and logoffs?

Answer

You can find console logon and logoff events in the Netwrix Access Analyzer event log. The event log file is located at:

%SystemRoot%\System32\Winevt\Logs\StealthAUDIT.evtx

Review Event ID 1000 and Event ID 1003 to learn more about accounts accessing the Netwrix Access Analyzer console.