Seems like event viewer would have some details.

"Michael Walsh" wrote:

> Yes, I enabled user auditing in SecPol.msc
>
> Now after a few days of working (with a couple of logon+logoffs) I wanted to see in
> the event log where the refering entries are.
>
> Where are they?
>
> I found only User="SYSTEM" logon entries in Security but no logoffs and no entries for other users.
> In System log as well.
>
> Can I audit logoffs at all?
>
> Michael
>
>