To enable logging of all logon/logoff attempts in the Security Event Log:

1. secpol.msc (as administrator)
2. Local Policy > Audit Policy
3. Audit account logon events policy
4. Check both the Success and Failure check boxes.