Windows

• Microsoft about Auditing

"Event Comb" from Microsoft

or

[url]http://www.microsoft.com/technet/security/guidance/secmod144.mspx[/url] [url]http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml[/url] -- PsLogList [url]http://www.gfi.com/lanselm/[/url] -- LanGuard S.E.L.M. -- trial download

Audit Logon/Logoff success events. The logon (528/540) and logoff (538

• events by ID at microsoft