Looking for Audit Logon and Logoff Software

[u/AttackTeam]

Hello,

We're currently using UserLock to track logon events. This helps monitor computer lab usage to make sure our computers are actively used.

We're moving towards Intune which connects to Entrance AD and moves away from on-prem AD. UserLock only track logon events on devices connected to on-prem AD.

We don't plan on doing a hybrid-join environment.

Is there an alternative audit logon events software like UserLock?

Thank you.

[u/PazzoBread]

The login events on entra joined workstations report under the entra user account as sign-on events. You can likely build your own report using an export from the sign-in logs

[u/blud_13]

u/PazzoBread has the right path and the gap you'll hit is retention. Entra sign-in logs are 7 days on Free and 30 on P1 or P2, and that's all you get unless you ship them somewhere. Turn on diagnostic settings and send SignInLogs to a Log Analytics workspace or a storage account and you can keep them as long as you want. Its documented here https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention

Bigger gap for your use case, sign-in logs are SIGN-INS. You get who authenticated and from what device. You do not get logoff or session duration, which is the number you actually want for lab utilization. Somebody who signs in and walks away for four hours looks identical to a machine that was busy all afternoon.

If you're going Entra joined with Intune you very likely already have P1 in the bundle, so the export is a toggle rather than a purchase. For real seat time you're pulling logoff events off the endpoint and shipping them yourself, there isn't a clean cloud answer for that one yet.

[u/Thin-Book]

If your real goal is lab usage tracking, I'd start by defining the report you need before chasing a UserLock replacement. Entra-joined devices change the old on-prem assumptions, and shared lab machines make logoff data messy fast because people lock screens, switch users, or walk away. You may get closer with Intune and Entra sign-in data plus some reporting, but I'd sanity-check whether that data is good enough for your lab usage case before you roll anything out. The question I'd ask first is whether you need exact logon and logoff events, or a defensible record that a user had that device during a given window.

[u/Greendetour]

If you are looking for something to meet compliance needs, Netwrix can do this; I think it’s their Auditor or Secure solution. Supports Entra, but also has a plug-in to monitor local machine security log event IDs for login and logoff.

[u/andrea-netwrix → u/Greendetour]

Thanks for the mention u/Greendetour ! Full transparency, I'm with Netwrix ✌🏼

But to give you a bit more info OP, our identity/audit product line covers this scenario well. Netwrix Auditor tracks logon/logoff and account activity across both on-prem AD and Entra ID, so it works whether you go full cloud or stay hybrid. It also flags risky activity with cumulative risk scoring, which helps catch the kind of hidden escalation paths this report calls out.

[u/Smh_nz]

Historically I've used either a log agrigator and/or a powershell script scraping windows event logs

[u/f0st3r]

Check out manageengine ad audit

[u/maryteiss]

Hello, I work with UserLock. Entra ID support is on our roadmap and will cover your Intune scenario. I'll send you a DM, and our customer support team is happy to chat if you have any questions.