Monitor Logon Activity

You can monitor a system's logon activity by starting the monitoring service before logon, either by connecting to the system from another machine or by starting the monitoring service via the command line in a logon script.

You can monitor local logon activity by starting with the -log option in a logon script.