You suspect an intruder has gained a connection to your network. You want to observe the number of unsuccessful logon attempts there were in one day to assist in scanning how the person got in. What action would you take?

If the Security logs can be configured to show both unsuccessful or successful logon attempts and object access attempts, the administrator can reconsider the Security logs and unsuccessful logon attempts to gain the expected information. When the failed attempts happened, the unsuccessful logs will point out the date and time.