Not surprisingly, exam prior to and after patching. You ought to be inside the practice of checking the login/logout moments of people. Typically a place Test will do. Personally, I just look for everything out of your everyday. As an example, a VPN consumer logging in at two PM from unrecognized IP