How can I keep track of offline AD logins in my server? This solution should work all windows server versions since 2000. Users will log in with windows machines.
Short of parsing and collecting all of the local logs on the machines in question, there's no way that I'm aware of. Logging in with cached credentials only generates local events.
That said, if you really need to audit it, you could always turn off caching of credentials via GPO. This wouldn't allow offline users to log in, but it would make sure that every single event is logged.