Certainly, examination right before and soon after patching. You have to be in the practice of examining the login/logout situations of end users. Normally a spot check will do. Individually, I just check for anything at all out from the ordinary. For example, a VPN user logging in at two PM from unrecognized IP deal with ought to be a red flag. It