Can someone recommend Window Security Auditing Best Practices?

I’ve been asked to provide upper management with details of when users log on and off the network. I know that this information is contained in the security event logs. But is there any specific event ID’s I should be looking for? Also what auditing should I turn on? Should I only turn on auditing on the domain controllers? Is there any reason not to turn on all the auditing in Group Policy? How much of a performance hit would this create? Sorry for so many questions just want to make sure I do this correctly. Thanks in advance for any help that can be provided.