View Active Directory logins per user

Hi - Thanks for quick input, audit is switched on however as per my comment the event logs only go back less than 24 hours due to overwrite when required.

From an earlier post of mine:
Another option is to add the lines below to each users logon and log off script to create a log file. It would give you UserName, ComputerName, date and time, in a simple single line, followed by the IP from which they connected, if needed. If you wish to know logoff times as well, you can add the same lines to a log off script in group policy (if you don't already have one: User Configuration | Windows settings | Scripts | Logoff). You likely wont need the last line (IP address) in the log off script.

As written below it will create the log/text file in \\Server\Logs\LogOns.Log and the entries will look like:
Log File

Log On:  jdoe SERVER1  Tue 1/1/2007   9:01
  TCP    10.0.1.100:3389        66.66.123.123:1234        ESTABLISHED
 
Log Off: jdoe SERVER1  Tue 1/1/2007   9:31

Log On:  jsmith SERVER2  Tue 1/1/2007   11:00
  TCP    10.0.1.200:3389        66.66.123.124:1234        ESTABLISHED
 
Log Off: jsmith SERVER1  Tue 1/1/2007   11:30
---------------------------------------------------------------------------

:Logging
If Exist "\\Server\Logs\LogOns.Log" GoTo START
Echo Log File > "\\Server\Logs\LogOns.Log"
:START
Echo. >> "\\Server\Logs\LogOns.Log"
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,16%  %Time:~0,5% >> "\\Server\Logs\LogOns.Log"
netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\Server\Logs\LogOns.Log"

Can you change the size limit?  If so I would increase the size.  If you can't you might just want to archive the logs daily and search through them manually based on the date.  

easiest way is to create a simple logon script batch file that echos the %computername%,,%username%,,%date%,,%time% to a .csv file in a central location.

echo %computername%,,%username%,,%date%,,%time%>>\\yourserver\logs\logs.csv

the double commas make it more readable

Try to filter Sucess audit logon events in Security . you will find many software, for event capture .e.g syslog. create one instance related to user login. So everytime if users login to domain , it will trigger a alert.

If you want mail, configure SMTP, so that it will sent the trigger to your account.

Thanks for the details, i eventually downloaded a trial software AuditAD - Would highly recommend it, it digs further than the audit logs.

Do you have a link?

Yes, would help if i said it correctly too ;-) ADAUDIT

I had to register for free to get the beta of ADAUDIT and got a new link back within 20 minutes. Have a look here... its good stuff!

http://manageengine.adventnet.com/products/active-directory-audit/index.html

Cheers ;o) Couldn't find AUDITAD anywhere!

ha ha, sorry about that :)

Thought that you were referring to this at first.

BTW, did you see the pricing for that adaudit?