您好,
您可通过查看以下事件ID来确定用户登录或者退出，以下也适用于server 2012
例如4624
表示用户登录成功.
https://technet.microsoft.com/en-us/library/dd941635(v=ws.10).aspx
https://technet.microsoft.com/en-us/library/dd941621(v=ws.10).aspx
另外这篇文章详细介绍怎么跟踪用户登录事件的IDhttp://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx
Best Regards,
Mary Dong
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
