LOG IN/OFF information for winXP/2K

Logon logoff events are not recorded by default. To enable:

1. Log on as an administrator
2. Click Start, click Run, type mmc /a (note the space between mmc and /a), and then click OK.
3. On the File menu, click Add/Remove Snap-in, and then click Add.
4. Under Snap-in, click Group Policy, and then click Add.
5. In Select Group Policy Object, click Local Computer, click Finish, click Close, and then click OK.
6. At this point, you might want to save this console for further use. Note you can add multiple snap-in and manage multiple computers from this console. I find it rather useful myself.
7. On the left hand side, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
8. On the right hand side, double-click "Audit Logon Events "
9. Check the boxes for Success and Failure, click OK
10. You can close the Microsoft Management Console, though you might want to snoop through the other possible settings first.

The events should now show up in the Security section of events manager.