I am finding the same problem with Windows 2008. I believe MS has somewhere defined the wrong event. If I start a screensaver that requires a password to restore then the Windows Loggon event gets triggered after entering the password, but never during a actual logon.