2
votes
1answer
726 views

How to differentiate between users and computers in EventID 4768 - Active Directory?

I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers. My problem is, that as far as I can see, I ...