User Identification Agent

[scanlab.rgr]

Hi,

I have a question concerning the User Identification Agent.
Yesterday we had  a problem with wrong user identification. The problem is solved in the meanwhile  but it would be nice for me to understand how the agent works.

To solve  the wrong identification I enabled the following audit policies on our  domain-controller:
Audit account logon events: Success, Failure
Audit  logon events: Success, Failure

Are both policies (success and failure)  necessary for the agent to work?
In the KnowledgePoint I found a hint that  the following event ID’s (Windows Server 2008) are recognized by the agent is this  correct?

LOGON_SUCCESS_W2008 = 4624,
AUTH_TICKET_GRANTED_W2008 =  4768,
TICKET_GRANTED_RENEW_W2008 = 4770,
ACCOUNT_USED_FOR_LOGON_W2008 =  4776

Thanks

[mharding]

The short answer is yes.

[scanlab.rgr]

Short but helpful.

Thanks.