Why does everybody want to make it so complicated? Enable logon/logoff auditing on the domain controllers and/or local computers and just pull the relevant information from the eventlog via e.g. ReadEventlog() - Retrieves event from the eventlog

Code:

$events = ReadEventlog('SELECT TimeGenerated, User 
                        FROM Win32_NTLogEvent
                        WHERE Logfile="Security" AND EventCode=538 
                        AND TimeGenerated>="20050801000000.000000-240"')

pulls all logoff events from the local computer after 2005-08-01 midnight using a 240 minute time offset from GMT.

See also Tracking Logon and Logoff Activity in Windows 2000
_________________________
There are two types of vessels, submarines and targets.