You can turn on logging but you must consolidate
the logs manually AND the user might logon to
a computer with cached credentials and not even
be authenticating.
You can try looking in WINS (or just broadcasting)
for the users name but again, if the user is logged
onto multiple places it will only show up on the
first one.