Would it be possible to clearly identify in the logs when someone successfully authenticated. Logs are full of garbage and going after Client Info is not enough.
Things to think about:
- NLA (confirmation of successful authentication) vs TLS (will have to be heuristic based)