Certainly, examination just before and immediately after patching. You have to be within the behavior of checking the login/logout situations of end users. Generally a location Check out will do. Personally, I just check for just about anything out of your common. For illustration, a VPN consumer logging in at two PM from unrecognized IP handle nee