We just installed AD Audit into our environment and I am loving it.

What I'm curious about is why do some users for a single day have 12000+ successful login attempts? Then the next day they have 20?

Is it normal for a Domain User to authenticate that many times to our domain controllers? I just find it shocking.

What could cause this sort of authentication activity?

Any direction or help is much appreciated!

Thank you.