User Logon / Session Duration

The following query will return the duration of user logon time between initial logon and logoff events. I have a duration filter set to greater than 5 seconds to weed out any scripts that may quickly log on and log off (change this as needed to fit your environment).

Windows 2008 and newer:

Windows 2003 and before:


#Admin Edit 12/17/2018 (fixed sourcetype and changed it to source…queries should work again).

Share This: