---
title: AuditLogonLogoff type | Wartiva GraphQL API
description: Logon/Logoff audit subcategories for authentication and session events. Wartiva GraphQL API reference with arguments, fields, and examples.
url: https://wartiva.com/api-docs/types/audit-logon-logoff.html
updated: 2026-10-07
---

Endpoint configuration · GraphQL type

# `AuditLogonLogoff` type

Logon/Logoff audit subcategories for authentication and session events.

## Fields

| Field Name | Description |
|---|---|
| `logon` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits each instance of a user logging on to or off from the computer. |
| `logoff` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits user logoff events. |
| `accountLockout` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits when a user account is locked out after exceeding failed logon attempts. |
| `ipsecMainMode` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits IPsec Main Mode negotiation events. |
| `ipsecQuickMode` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits IPsec Quick Mode negotiation events. |
| `ipsecExtendedMode` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits IPsec Extended Mode negotiation events. |
| `specialLogon` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits special logon events, such as using an account with administrator privileges. |
| `otherLogonLogoffEvents` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits other logon/logoff events not covered by specific subcategories. |
| `networkPolicyServer` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits Network Policy Server (NPS) authentication and authorization events. |
| `userDeviceClaims` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits user and device claims information during logon. |
| `groupMembership` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits group membership enumeration during logon. |
| `accessRights` - [`AuditPolicySetting!`](https://wartiva.com/api-docs/types/audit-policy-setting.html) | Audits access rights granted or denied during logon. |

## Used by

- [`AuditPolicyWindows`](https://wartiva.com/api-docs/types/audit-policy-windows.html) type: Windows-specific Advanced Audit Policy Configuration.

## Example

### Example

```json
{
  "logon": "SUCCESS",
  "logoff": "SUCCESS",
  "accountLockout": "SUCCESS",
  "ipsecMainMode": "SUCCESS",
  "ipsecQuickMode": "SUCCESS",
  "ipsecExtendedMode": "SUCCESS",
  "specialLogon": "SUCCESS",
  "otherLogonLogoffEvents": "SUCCESS",
  "networkPolicyServer": "SUCCESS",
  "userDeviceClaims": "SUCCESS",
  "groupMembership": "SUCCESS",
  "accessRights": "SUCCESS"
}

```

---

Wartiva is in early access. Request access: https://wartiva.com/early-access.html  
All pages: https://wartiva.com/llms.txt