JSI Tip 0264 - Auditing logons.

When you enable auditing of logons in User Manager for Domains \ Policies \ Audit.., records appear in your Security log in the Event Viewer.

Many of these records appear to be identical at the summary level but if you view the detail you will see a difference. Here are the common logon/logoff events:

D e s c r i p t i o n	Event ID	Event Type
Interactive logon	528	2
Interactive logoff	538	2
Network logon	528	3
Net Use connection*	528	3
Network logoff	538	3
Net Use disconnection	538	3
Autodisconnect	538	3

Note: * - An event is only generated by the initial connection from a particular user.
              Subsequent Net Views or Net Uses from the same user to the same computer do not generate any
              additional events unless the user has disconnected (or has been autodisconnected) from all shares.

See tip 749, More on auditing logons.