We monitor logon events and produce a report of which admins logged on where for auditing purposes. I wrote a quick powershell prompt that asks them to input the reason why they are logging into the server each time. This information is written to the "Application event log" under the "User Profile Service" source. Is there any way to get this information out of LEM? I can't seem to find any of the events showing up in LEM. Is there a better Event log or source I should write to that LEM can pick up? I cannot write to the security log because it's owned by the system account on the server.
Thanks for the help in advance!