Hi There
I'm having an issue where logon events for certain accounts, functioning as "service accounts" are not registered\recorded in the security event log on Domain Controllers.
When viewing the LastLogon attribute on the user object I can clearly see the time when the account logged onto the specific DC. However when I then go to the security event log and look at the logs for the same time period nothing is recorded. I've even gone so far as to enable debug logging on a DC in an attempt to find the source. To my surprise even though the LastLogon attribute for the object on that DC got updated, it was not picked up in the netlogon.log file.
Has anyone experienced this? Are there some cases where the lastlogon attribute gets updated but not recorded in any logs?
Thanks