When you enable auditing of logons in User Manager for Domains \ Policies \ Audit.., records appear in your Security log in the Event Viewer.
Many of these records appear to be identical at the summary level but if you view the detail you will see a difference. Here are the common logon/logoff events:
|D e s c r i p t i o n||Event ID||Event Type|
|Net Use connection*||528||3|
|Net Use disconnection||538||3|
Note: * - An event is only generated by the initial connection from a particular user.
Subsequent Net Views or Net Uses from the same user to the same computer do not generate any
additional events unless the user has disconnected (or has been autodisconnected) from all shares.