If you’re trying to audit the Last Logoff time of users in Active Directory or to programmaticly confirm whether someone is still logged on, your intuition might tell you to monitor the lastLogoff attribute. Unfortunately, you’d be wrong.
Active Directory does provide a User object attribute named lastLogoff where logoff Information should theoretically be stored. However, Microsoft currently does NOT utilize this attribute to store logoff information. [more info on that]
In order to monitor User logoff activity on your own, you would need to watch the Security Event Log at every DC. And you’d need to configure the Security Event Log policy on each relevant server to monitor logoff events. You would also also need to ensure that the event logs aren’t being overwritten before you capture the information (which can be tricky in large environments if you’re capturing all logon and logoff activity). And you would have no ability to filter the events so that you’re getting only relevant information.
Because Microsoft doesn’t update Active Directory information during a logoff event, NetVision also monitors the event logs to capture logoff events. But, because we’re already installed, there’s nothing else you need to do. And we give you the ability to filter events based on what’s important to you (such as limiting Logoff events to a particular subset of Users). The resulting reports are easy to read, exportable, and stored independent of logs so they’ll never get overwritten.
Note: Monitoring Logoff events is never 100% reliable. This blog entry from the Windows auditing team explains why.