I write a file at logon named after the computer where the logon occurs. The file is written to a hidden share on the logonserver authenticating the user. An admin program walks the DC's hidden shares and collects the files, parses them, and write the data into an Oracle database so that it can be queried.
This has been the most robust and network friendly methodology I could come up with over the years.
