$ 0 0 As far as i know, Logon Type one is only WMI. Type 2 is Login Event. Seems like your Client is not able to read the Event Log.