Using standard Windows security logs im trying to chart user sessions for TimeLoggedIn and TimeInactive
TimeLoggedIn = logged out time - logged in time
TimeInactive = ConnectTime-DisconnectTime
Im guessing the best Events would be times between each Account Name occurrence for:
EventCode 4634 Account was logged off
EventCode 4624 Account successfully logged on
&
EventCode 4800 Workstation was locked
EventCode 4801Workstation was unlocked
What would be the most efficient method for tracking this as there are alot!
↧