Security Event Question

[IT4EVR]

I'm developing a Security Event auditing application. I'm trying to determine what event I should use in order to derive both the user name and the computer name of the user logging on to the network.

I've tried event 528 but I don't think that relates to network logons. I've tried 672 but that will give me the computer name of the server the user is logging into, not that actual computer name of the user. It does provide the IP but it's quite an expensive operation to reverse the dns on IP addresses on a huge event log.

Is there such an event or combination of events where I can derive the computer name of the user and the user name?

Thanks in advance...

 

[IT4EVR]

Or could I just get this information out of Active Directory?