How to audit computer users from login on and login off of the computer - TechNet Articles - United States (English) - TechNet Wiki

I believe most of the Geeks who are working in either SBS or MNC does have certain concerns in auditing users. With the below scripts it will assist you to do.

Such ideas can be implement via Group policy.

Kindly follow below steps:

1) Enable auditing on the Domain controller.

2) Access your group policy management console. Either gpedit.msc or GPMC
navigate to computer configuration/windows settings/Security Settings/local policies/auditing policies

Select <audit account logon>

Else you may do it this way like what I normally do.

Create a logon script >

echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver%>>\\server\sharename$\logon.log

Create a logoff script

echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver%>>\\server\sharename$\logoff.log

Script options can be powered by WMI/ADSI to query each Domain controller for logon and logoff events.