http://blogs.msdn.com/ericfitz/archive/2007/05/08/the-trouble-with-logoff-events.aspxA lot of you guys probably are using your SEM/SEIM systems to record logon and logoff activity without much of a second thought. I just thought I'd bring one problem to your attention. Logoff events are not strictly reliable. From an engineering senseen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/ericfitz/archive/2007/05/08/the-trouble-with-logoff-events.aspx#4210968Fri, 03 Aug 2007 23:36:34 GMT91d46819-8472-40ad-a661-2c78acb4018c:4210968Domain User Logon and Logoff Events « Steve Mullen’s Blog<p>PingBack from <a rel="nofollow" target="_new" href="http://skmullen.wordpress.com/2007/08/03/domain-user-logon-and-logoff-events/">http://skmullen.wordpress.com/2007/08/03/domain-user-logon-and-logoff-events/</a></p> http://blogs.msdn.com/ericfitz/archive/2007/05/08/the-trouble-with-logoff-events.aspx#8882822Thu, 21 Aug 2008 03:25:51 GMT91d46819-8472-40ad-a661-2c78acb4018c:8882822Windows Security Logging and Other Esoterica<p>I get the question fairly often, how to use the logon events in the audit log to track how long a user</p>