A quick bing search (you read that right) showed me this that contains the events for logon and logoff along with session connections, locked workstations, and the screensaver. You may also want to watch for idle events too. http://www.morgantechspace.com/2013/10/tracking-user-logon-activity-using.html
- Stephen From: [email protected] [mailto:[email protected]] On Behalf Of Boyles, Peter J {BIS} Sent: Thursday, July 09, 2015 5:28 PM To: [email protected] Subject: [NTSysADM] RE: user logged in time Enable audit of security events for success and failure of logon and logoff Check security event log for: Event ID 4648 Logon Event ID 4634 Logoff Peter Boyles BIS Engineering Analyst PepsiCo Inc. | Global End User Services | GEUS Deploy From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of David McSpadden Sent: Thursday, July 9, 2015 12:54 PM To: [email protected]<mailto:[email protected]> Subject: [NTSysADM] user logged in time I want to see in general when a user logged into a workstation. So I am looking in the local workstation, Security events, for ....what?? David McSpadden Systems Administrator Indiana Members Credit Union P: 317.554.8190 | F: 317.554.8106 [Description: imcu email icon]<http://imcu.com/> [Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU> [Description: twitter email icon] <https://twitter.com/IndMembersCU> [Description: email logo] [mcp2] This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email.
