If you are running SQL 2008, then a server-side trace with Audit login success and Audit logout. If you're on 2012 or above, the same thing with Extended Events.
Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability