we have few win xp machines connected to an win2k domain controller. How do I generate a report or view login and logout times from those machines
If you have the right audit settings on the DC logon events should be recorded in the security log.
Or you could apply a batch file via group policy to the machines you would like to monitor. Obviously this would only log times from the time applied though...
Edit as needed.
I believe OldCmp will produce a report on login times. Regardless, the JoeWare tools are incredibly handy, particularly for a pre-2008 domain.
It depends on what you're looking for. I assume you're trying to get a list of times / dates of interactive logons (i.e. user sitting at the computer, user using RDP, etc) from client computers.
To do this, you're going to have to do this by monitoring the client computers. "Logon" and "Logoff", with respect to Windows Server computers and remote connections, isn't like TELNET or SSH sessions. When a user logs-on interactively to the client computer that doesn't open some persistent connection (like a TELNET or SSH session) to a server computer that can be monitored. You'll see logon events on your server computers when users logon to client computers interactively, but you'll have a logoff event on the server computer for a given client due to idle timeout, very likely, before the user actually logs-off of their interactive session on the client computer.
Assuming you're auditing "Logon" events on client computers you could either parse their event logs after-the-fact, or do something like creating an event log sink to monitor interactive logon and logoff events on each client computer and report them back to a central database.
Utimately, monitoring interactive logon times in the event logs of client computers should be fairly reliable. You'll have to watch out for crashes and reboots that might end users' sessions so there would need to be some special-case code to watch out for unexpected restarts (and the functionality to log unexpected shutdowns would need to be turned on... I think it's only on in Windows Server versions, by default).