Audit logon events
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy
Determines whether to audit each instance of a user logging on, logging off, or making a network connection to this computer.
If you are auditing successful Audit account logon events on a domain controller, then workstation logons do not generate logon audits. Only interactive and network logons to the domain controller itself generate logon events. In short, "account logon events" are generated where the account lives. "Logon events" are generated where the logon occurs.
By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.
If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when logon occurs successfully. Failure audits generate an audit entry when an attempted occurrence of the logon fails. You can select No auditing by defining the policy setting and unchecking Success and Failure .