Comments by robow3 (Top 1 by date)

thanks for quick reply.

i'm trying to get user's logon and logoff time from the event viewer. And also trying to get the user working time.
So first i'm enable the audit log first. Then clear all audit log. Now i'm login from network machine as a domain user or a local user in my server. More than 15 to 60 logs for this single login in event viewer.
In this logs, login event(4624) is more than 5 to 20. Now how can trim and get original login event. I already try with login id and logon guid of logon event parameter. But its also gives more
events. So i could not get the correct logon and logoff time of the user. I strike more than a week in this problem.