|
In the code it shows that the interactive logon event ID's are:
Case EventID When 528 Then 'Logon' When 551 Then 'Logoff' END
when:
EventID = 551 Or EventID = 528 AND EXTRACT_TOKEN(Strings,3,'|')='2' And EXTRACT_TOKEN(Strings,4,'|') like 'User32%'
Why don't you just run my code (using a Group Policy statup script or system scheduled task set up by Group Policy) on each machine and dump it into a DB?
| 
