I don't think the default configuration of Windows include the relevant events. I'd like to get all interactive logons, but also failures and logoff events. It would be great to have documentation that show how this is done on Windows Servers (2016 and later, domain and standalone).