As with all policy settings, you should define the scope carefully for the GPOs that apply your audit
policies so that the settings affect the correct systems.
For example, if you want to audit attempts by users to connect to remote desktop servers in your enterprise,
you can configure log on event auditing in a GPO that is linked to the view that contains your remote
desktop servers.
However, on the other hand, if you want to audit desktop log ons by users in your human resources
department, you can configure logged on event auditing in a GPO that is linked to the EU that contains
human resources, computer objects.
Remember that a domain user who signs into a client computer or connects to a server will generate a
log on event, not an account log on event on that system.
Only domain controllers generate account.
Log on events for domain users.
Remember that an account log on event occurs on the domain controller that authenticates a domain user
regardless of where that user logs on.
If you want to audit, log on to domain accounts.
You should ensure account log on event auditing to effect all domain controllers.
The default domain controllers GPO that is created when you install your first domain controller is
an ideal GPO in which to configure account logon audit policies.