Needless to say, check right before and right after patching. You should be while in the behavior of examining the login/logout times of end users. Typically a location Look at will do. Personally, I just look for everything out from the standard. For illustration, a VPN user logging in at 2 PM from