Hi Mike, we do make use of that app however there are far more logon events then we have active users in our system at any given time. I was searching based on EventCode=4624 which is a successful logon event. Do I need to do some kind of search of successful login events and then exclude users that have logoff events within like 30 seconds or so to find total users that are logged in? if so not sure how to drill up a search like that so anything that could point in the right direction would be helpful. I will continue to review the doc's for now.