Enable auditing of logon events on the Terminal Server and you will see user
logons/logoffs in the security log which can be viewed with Event Viewer.
Make sure you increase the size of the security log quite a bit from default
to probably around at least 5 MB. See the links below for more details that
include explainations of the various logon events you will see in the
security log. --- Steve
