On the Domain Controller(s), configure the Policy:
Policies > Windows Settings > Security Settings > Local Policies > Audit Policy >Audit account logon events to
Enabled, Success. Do this with a group policy object assigned to the Domain Controllers organization unit of the domain.
Once the DCs have updated their policy (you can force them with
gpupdate) an event will be generated in the Security log for every successful logon. Within the event, it will list the Account Name (ie, the username), along with the Source Network Address (IP of the workstation). It will sometimes fill in additional fields depending on the logon type, but those two are reliable.