I thought there was a way that we could look up events in ePO showing when the ENS Administrator Logon password was used to unlock the ENS Console on a system. I can't find anything in ePO to query though. I do see an event logged in the EndpointSecurityPlatform_Activity.log showing this:
|Activity|MFEConsole |MFEConsole | 29464| 24444|PW |mfeux_extension.cpp(408) | Successful login attempt
Can someone point me to a way to query for that in ePO or know if it's possible? I definitely recall back to VSE seeing events for it in ePO but I am not seeing anything for ENS. Thanks.