Reviewing Logons by Privileged Accounts

Returns logons for user accounts belonging to a predefined set of known privileged domain accounts (Enterprise Admins, Schema Admins, Administrators, Domain Admins, Server Operators, Account Operators, Backup Operators, and DS Restore Mode Administrator)

Returns logons for user accounts belonging to the local Administrators group

Select specific domain accounts that you know to be privileged or potentially interesting (for example, if a customer tells you "IT Admins" is a privileged group)