Any time you log in a DC in a event is registrered in event log, in the same way, a event is registrered when a user logout.
Some users may leave their session open, but is easy to see when viewing the user downtime activity.
The system should only record the login or logout events of the selected domain users, not every login or logout events,
because there are too many to consider.
Using the Share and Storage Management Console in Windows Server you easily see all user login in a specific file
server and you can close specific session or all active sessions on that server.