Windows networks: why is logon/logoff reporting important?
There is no way in Windows to get a report saying “John logged on at 8:00 and he logged off at 11:00.”
It is therefore a precious information that gives System Administrators the ability to answer crucial questions when it comes to investigations following an incident. Who was really logged on? Where were they logged on? When did they log on? How long did they remain logged on? When did they log off? At any given time, which people were actually logged on at their Windows systems?
