NewbyOne

Thanks Tony, I found the culprit. It was due to the type of view limitation on the view. I was able to change the limitation to another set and it then worked. What was strange was the original was a Group of Groups but it didn't seem to like nested groups. Regardless, this is resolved. 

Thank you for your reply. Yes, the event logs are set by GPO to capture logins. This would be for any user, AD or local logins. Trying to get this done in SAM preferably as purchasing another module isn't going to happen in the near future. Just need SAM to tell me who, when user logs into a server. Thanks

Thank you for your reply. Yes, the event logs are set by GPO to capture logins. This would be for any user, AD or local logins. Trying to get this done in SAM preferably as purchasing another module isn't going to happen in the near future. Just need SAM to tell me who, when user logs into a server. Thanks