On your DC(s), open an Admin command prompt and try this command:
auditpol /get /category:"Logon/Logoff"
What are the results? Are there LEM agents on your DC(s)?
On your DC(s), open an Admin command prompt and try this command:
auditpol /get /category:"Logon/Logoff"
What are the results? Are there LEM agents on your DC(s)?