Certainly, check just before and soon after patching. You ought to be from the practice of checking the login/logout times of users. Usually a location check will do. Personally, I just check for everything out in the ordinary. For example, a VPN person logging in at 2 PM from unrecognized https://murrayr122ztm5.wikinarration.com/user