Question: where are audit logon events stored?
Answer: Such account logon events are generated and stored on the domain controller, when a domain user account is authenticated on that domain controller. For local user accounts, these events are generated and stored on the local computer when a local user is authenticated on that computer.