eventvwr only shows pc turning off + on afaik..

You have to configure the Local Security Policy under Administrative Tools. Under Audit Policy log Sucess and/or Failure under Audit Logon Events.

This sucks though. You have to then filter the events to show just a simple log on and logoff entries. A logon event is a few different entries and well as logging off. At least the last time I tried it. I wound up using Kixtart to write a script that audits to a textfile that my client can print everyweek to make timesheets for his employees.

http://www.kixtart.org/

KAndle

http://www.KAndleConsulting.com