The logging is good idea, if the user only logged into a single PC. Most of our users have 2 PCs. How would I know what log to get and where? If it's one big log, thats going to be a BIG log.

How do I query the PDC's event log?