The logon application works with Logon Agent. It runs from a logon script on a domain controller to capture logon sessions as users log on to, or log off of, Windows domains in the network. The logon application (LogonApp.exe), runs as a process on client Windows machines. At log on, the logon application identifies the user and sends the information to Logon Agent.

The logon application runs only in conjunction with Logon Agent. The Group Policy on domain controllers must be modified so it launches LogonApp.exe as part of the logon script. Client machines must use NTLM (v1 or v2) when authenticating users.