Easiest way is to enable logon/logoff auditing on the server and monitor for the event that's created in the event log if you don't mind a ton of events or if it's a small network.

Legacy Forum Name: Monitor Sets,
Legacy Posted By Username: Intech-Jason

[QUOTE=Intech-Jason;61376]Easiest way is to enable logon/logoff auditing on the server and monitor for the event that's created in the event log if you don't mind a ton of events or if it's a small network.[/QUOTE]

One should be able to monitor the audit logs for a specific user, mind you if the network has multiple DC's you'll need to have the alert on all of them, not just the primary.

Legacy Forum Name: Monitor Sets,
Legacy Posted By Username: thirteentwenty

Thanks for the input.

I ended up creating an Agent Procedure to dump the Security Log to a .txt, parsed for the username, and notified if it was found.

Legacy Forum Name: Monitor Sets,
Legacy Posted By Username: jholbird