Event 528 Not Appearing

Question

OK From what I can read on the interwebs, I should see two events when a user logs in:
> Event 4624 on the domain controller indicating the "Account logon"
> Event 528 on the workstation indicating a "Logon" event of type 2 or something.
The 4624 I'm seeing in spades on the DCs.
The 528 event not at all. (This is on Windows 7 x64 workstations).
Now, we are using advanced security policy settings on the workstations.
All of the instructions I see for auditing logon events use the "old" GPO settings.
Here's the results of Auditpol.  Why do I not see event 528?
C:\TEMP>auditpol /get /category:*
System audit policy
Category/Subcategory Setting
System
Security System Extension Success and Failure
System Integrity Success and Failure
IPsec Driver No Auditing
Other System Events Failure
Security State Change Success and Failure
Logon/Logoff
Logon Success and Failure
Logoff Success and Failure
Account Lockout Success and Failure
IPsec Main Mode No Auditing
IPsec Quick Mode No Auditing
IPsec Extended Mode No Auditing
Special Logon Success and Failure
Other Logon/Logoff Events Success and Failure
Network Policy Server Success and Failure
Object Access
File System Success and Failure
Registry Success and Failure
Kernel Object Success and Failure
SAM Success and Failure
Certification Services Success and Failure
Application Generated Success and Failure
Handle Manipulation No Auditing
File Share Success and Failure
Filtering Platform Packet Drop No Auditing
Filtering Platform Connection No Auditing
Other Object Access Events No Auditing
Detailed File Share No Auditing
Privilege Use
Sensitive Privilege Use No Auditing
Non Sensitive Privilege Use No Auditing
Other Privilege Use Events No Auditing
Detailed Tracking
Process Termination Success and Failure
DPAPI Activity Success and Failure
RPC Events Success and Failure
Process Creation Success and Failure
Policy Change
Audit Policy Change Success and Failure
Authentication Policy Change Success and Failure
Authorization Policy Change Success and Failure
MPSSVC Rule-Level Policy Change Success and Failure
Filtering Platform Policy Change No Auditing
Other Policy Change Events Failure
Account Management
User Account Management Success and Failure
Computer Account Management Success and Failure
Security Group Management Success and Failure
Distribution Group Management Success and Failure
Application Group Management Success and Failure
Other Account Management Events Success and Failure
DS Access
Directory Service Changes Success and Failure
Directory Service Replication Failure
Detailed Directory Service Replication Failure
Directory Service Access Success and Failure
Account Logon
Kerberos Service Ticket Operations Success and Failure
Other Account Logon Events Success and Failure
Kerberos Authentication Service Success and Failure
Credential Validation Success and Failure
C:\TEMP>

Answer 1

Hi,
Please check if you could find event id 4624 on workstation of Windows 7. Since the pre-Vista events id start with 5xx, the Windows 7 events id start with 4xxx.
Thus we couldn't find the 528 entry.
For more information, please read this article:
Description of security events in Windows 7 and in Windows Server 2008 R2
https://support.microsoft.com/en-us/kb/977519
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]