With native auditing, here is how you can monitor employees' logon activities.

• Step 1: Enable 'Audit logon events' policy

• Launch Server Manager in your Windows Server instance.

• Under Manage, select Group Policy Management and launch the Group Policy Management console.

• Navigate to Forest --> Domain --> Your domain --> Domain Controllers.

• Create a new GPO and link it to the domain containing the user object, or edit any existing GPO that is linked to the domain to open the 'Group Policy Management Editor'.

• Navigate to Computer Configuration -> Windows Settings -> Security Settings ->Local Policies -> Audit Policy.

• Under Audit Policy, select Audit logon events and turn auditing on for success.

  

• Step 2: Enable Logon/Logoff auditing

• Now, navigate to Computer Configuration -> Windows Settings -> Security Settings ->Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff.

• Under Logon/Logoff, turn on auditing for Audit Logon, and Audit Special Logon (Turn on auditing for success).

  

• Step 3: Track employee workstation logons in Event Viewer

• Every time a user logs on, an event log will be recorded in the Event Viewer. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.

• To filter the event logs to view just the logs associated with employee work hours, select Filter Current Log from the right pane. Simply search for the event ID 4624 (account was logged on).

  

  Using this information, you can track a user's logon activity. You will need to repeat this multiple times if you want to monitor logons of multiple users.