In Windows 2000, to get the registry key for logging:

$value = READVALUE ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit","LastWinLogonConfig")
This is a "REG_DWORD" value.
If logging is disabled for success and failure the value is:
704670333 (DECIMAL), 2a006a7d (HEX)

If logging is enabled for both, you get:
2a0068df (HEX), 704669919 (DECIMAL)

For logging enabled for success only:
2a006ca7 (HEX), 704670887 (DECIMAL)

For logging enabled for failure only:
2a006ce1 (HEX), 704670945 (DECIMAL)

At least this is how it appears to work on my Win2k System. I assume it's totally different for NT. That's not all... You have to be able to set the security for auditing functions. By default, no user is given auditing rights. This is the tough part because it's encrypted in the registry. You have to give logged on users auditing access to the winlogon registry key for auditing to work. How to make this work is a big guess. Someone else might know of a tool that allows you to add auditing security to someone's user ID. I would assume you have to have administrator access on the PC to change the security settings....

Another thing.. auditing settings on Windows 2000 can be overriden at the domain level, so the best way to do this may NOT be logon scripts.. just a thought.

(I don't have NT, but this is information I found looking at Windows 2000.)

Brian