You need to ensure that members of the Security Compliance Active Directory Domain Services (AD DS) security group can monitor failed logon events on the VMs