Not surprisingly, exam before and right after patching. You need to be from the behavior of checking the login/logout periods of people. Normally a spot Examine will do. Personally, I just look for just about anything out from the standard. For instance, a VPN user logging in at 2 PM https://israelfbvoh.theobloggers.com/42180090/detailed-notes-on-managed-it-solutions-in-uk