Dashboard report showing who is logged on
Has anyone been able to create a Dashboard report showing who is currently logged on to a windows server?
The problem I have is that each user seems to have lots of logon (540) and logoff (538)
( so I can't just have a rule that says 'if logon 540 and not logoff 538', It's got to look for a logon that is more recent than alogoff)
This is an excellent idea. However I don't think this can be (currently) accomplished via the reporting/dashboard system. What you really want to do is match the Logon ID field from the windows event log between the logon and logoff events.
What you might be able to do is create a correlation rule (which can track states) and then your dashboard report can be based off the correlation rule. I suspect this will be tricky as well. How big of an environment is this?
If you switch to using Event Explorer, then I believe you should be able to create this using an advanced table.