Step 1: Enable Audit Policy

Open Server Manager on Windows server.

Under the Manage tab, open the Group Policy Management console.

Go to Forest -> Domain -> Your Domain -> Domain Controllers.

You can either edit an existing group policy object or create a new one.

In the Group Policy Editor, navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy.

In Audit Policy, select 'Audit logon events' and enable 'Success' and 'Failure' auditing.

Step 2: Enable logon-logoff

Go back to Computer Configuration. Navigate to Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policy -> Logon/Logoff.

Under that, enable Success and Failure auditing for Audit Logon, Audit Logoff, and Audit Special Logon.

Open the Group Policy Management console and select the GPO that you have edited or created. Under Security Filtering, add the users whose logons need to be tracked. You can also choose to audit every domain user's logon by selecting All users. To audit a group of domain users, the specific group(s) can be added.

Step 3: Use Active Directory Event Viewer to check the logs

Open Event Viewer and navigate to Windows logs -> Security.

Look for the event IDs 4624 (Account was logged on), 4634 (Account was logged off), 4647 (user initiated logoff), 4672 (special logon), 4800 (the workstation was locked), and 4801 (workstation was unlocked).

Click Filter Current Log on the right side to filter the logs based on event IDs or the time range for which the information is required.