I've already made a system to capture logins which is pretty useful (And it also captures double logins or suspicious logins and flags them up which is handy )
Not to hijack your thread, but would you mind sharing this. I currently have a logon and log off script that write date/time username ip address mac address and computer name to a file. It does not flag anything and is pretty basic.
I would like to look at your solution.