Winlogon event id 801/802 not coming under Microsoft-Windows-Winlogon event viewer.

[RahulPathak2]

Hi All, I am looking for event id 801/802 under Microsoft-Windows-Winlogon.These events corresponds to "NotifyExecute" as mentioned here :https://raw.githubusercontent.com/r...n10-17134/Microsoft-Windows-Winlogon.xmlOther event like 811/812 are coming as we can see following sample:Information 24-03-2023 14:34:12 Winlogon 811 (811)The winlogon notification subscriber <TermSrv> began handling the notification event (5).Can anyone help here on how can we get those 801/802 events. Do I need to set som

Continue reading...