Is there a way to monitor when a specific user account logs off a Windows server?
If so how would I set this up in SAM.
You would use SAM's Windows Event Log Monitor to watch the Security Event Log for Event ID 538.