You’ll need to enable Audit Logon Events in group policy then you can use eventcombMT to filter the required events out of the event log (available as part of the following download )
http://www.microsoft.com/downloads/details.aspx?familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e&displaylang=enYou’ll then have to audit the individual events (540, etc) Alternativley you may find it easier to do the following:
http://support.microsoft.com/kb/556015 (logon/logoff scripts)