LoginID is a unique hex value assigned to each logon session. If you
cross-refrence the LoginID from a Successful Logon event with the same
LoginID from a Successful Logoff event, you can determine how long the
session lasted (i.e., how long the user was logged on to the system).
cross-refrence the LoginID from a Successful Logon event with the same
LoginID from a Successful Logoff event, you can determine how long the
session lasted (i.e., how long the user was logged on to the system).
Foundstone's free...
[ more ]