If someone can help me out. I would like a log which lets me know when a user logs in and out of a 2008 terminal service session. It should have the users login name. Is this possible? I can't find the event ID that would give me the info I am looking for. 528 is not showing up. Has anyone written a script to do this?