For the Web Access you can do it easily. Filter Field select "Message Text" , IS , Like, 4624. 4624 is the event id for an "An Aacount was successfully logged on." Then do the same for 4634 "An account was logged off." That should get you started, hope it helps.
↧