STAS & WMI Logoff - How to debug?

Hi,

So we have got a STAS setup in a multiple domain controller environment. It is super quick at registering user logging onto the domain. However it doesn't seem to be seeing users logging off or using the WMI to query users that have logged off.

Client:

Domain connected

No Firewall

Server:

I have tried with a Service Account that is full administrator to everything (I will be locking this down once we can prove this works!)

WMI from server using the service account name has access to the WMI query using the command line

Is seeing logons and filtering correctly.

But no logoff unless a user is logging into the same machine (therefore logging off another user)

In the log files there is no mention of an attempt to query WMI at any point. How detailed are the log files - how do we know if STAS is actually polling using WMI??

Thanks

Ed