Our desktop support team grants everyone an account for daily activities in the company, and also grands a local administrator account for specific people (mostly developers) so they can install software by themselves without having to request for help from support.
The process is meant to be the following one : they use their main account on a regular basis, and if required, they input their local admin credentials in the UAC prompt.
However, I do not want them to open the desktop session as an admin and perform all their daily tasks here, for obvious security reasons.
I would like to audit on Domain Controller side the logon events to identify is some users actually use the admin account as a default account, but I cannot find any documentation related to different logon type (desktop logon VS UAC prompt).
Is there a way to perform such tasks from Windows Event Log ?