Certainly, examination just before and after patching. You ought to be during the practice of examining the login/logout instances of customers. Generally a location Examine will do. Individually, I just check for nearly anything out of your everyday. For instance, a VPN user logging in at 2 PM from unrecognized IP handle should be a crimson flag.