• Distinguishing Windows NT Audit Event Records
  Auditing log on and log off events on Windows NT Workstation or Server versions 3.5 and 3.51 produces records in the Security Log. However, what appear to be identical records in the Security Log may actually record network log on and log off...
  in Computers with 3.5 auditing events log server versions windows workstation

3.5 from all users