Glenn, that short snippet of code seems to have done the trick. I've tested it multiple times and it's working just as I need it to - the audit.exe runs only when someone logs into a system at the console and doesn't run at all if you log into a system via RDP. Thanks for your help with this.