According to http://www.windowsecurity.com/articles/logon-types.html
, I should see "Logon type:2" on the DC when a user logs in, but all I see are Type:3". There's no log filtering in place.
The Type:3 events do align with when a given user logs in, but there are more than a dozen such related events within a minute of an actual at-keyboard logon which makes the logs hard to parse.
I've made sure that the user is actually logging in and not just unlocking the computer.
Should I not see type:2 in the security logs?