Needless to say, check right before and immediately after patching. You should be during the practice of checking the login/logout instances of end users. Typically a location Test will do. Individually, I just check for anything at all out with the normal. As an illustration, a VPN person logging in at two PM from unrecognized IP deal with need to