If you're going to examine ldb type files then I can only see it working if you have captured their machine name via something like fOsUserName, which is a function that uses API calls. Or you can compare user table machine id values against what's in the lock file. fOsUserName is readily available, but you might need to be concerned about 32 vs 64 bit versions, so I'd use a version that's written for both if I went that way. However, neither of these are much good if a person can move around and use different pc's from one login to another.
Maybe state what your concerns are and what it is you want in general terms. For example, is this a historical record of log ins only? Log ins and log outs? Either/both but not historical? Active connections only? There's not much you can do about abnormal shutdowns if you're relying on records to indicate active connections.
The more we hear silence, the more we begin to think about our value in this universe.
Paraphrase of Professor Brian Cox.