Abstract: A system is provided comprising a computer and application, that when executed, observes login and logout events at a client workstation enabling and disabling access to an operating system executing on the workstation. The system observes a first login and logout event and a second login and logout event occur in order. The system determines first and second exceptions when the time of the first login and second logout events vary from scheduled first login and second logout times by greater than first and second predetermined time intervals, respectively. The system determines a third exception when the time between the first logout and second login event exceeds a third predetermined interval. The system determines a fourth exception when either the first logout or second logout event does not occur before the end of the period. The system also reports the first, second, third, fourth exceptions to a workforce management function.