I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers.
My problem is, that as far as I can see, I am allowed to set usernames like 'abc$'. So differentiating based on '$' is not the best way.
I also can't see any other difference between 2 events, one from computer and one from user logon.
So, how to safely differentiate between users and computers when I am catching logon events?