When a user logs on they are provided with a Kerberos Ticket Granting
Ticket, but the connection doesn't stay open. When a user request
resources the ticket is used but we dont keep an open connection to the DC.
I am not aware of any method that would be able to provide this type of
info.
For example how would a computer/user that lost its network connection be
accounted for?
This scenario would grow exponentially when you consider a domain with
multiple DCs each possibly authenticating a domain logon.
