Obviously, test in advance of and just after patching. You need to be within the habit of checking the login/logout times of end users. Typically a location check will do. Personally, I just look for anything at all out with the regular. For instance, a VPN user logging in at two PM from unrecognize