Auditing logon\logoff events w/W2K3 server

I understand how group policy works and I have turned on auditing for user logon events but its capturing way more information then I initially wanted.

My manager wants to capture logon/logoff events to ensure when certain people are saying they are at work logged on and working they really are.

Is there anyway to narrow this info down. Also I had my co-worker log off and log back on and it didn’t seem to capture it. Did I not turn on the right auditing function on the domain controller?

Any help is appreciated. Thanks.