you should consider starting the audit logon events option