Overview
To perform this exercise, you should have already completed the “Viewing event logs” exercise. If you have not, you will need to enable logon monitoring with a group policy and generate a failed logon event, as explained in the first step of the exercise.