Windows DC event logging - See WHERE a user is logging into.

Hi ArcSight fans,

I am looking into an issue with Windows DC logs. I'm pulling security logs from a few DC's and wanted to know if there is any way for me to capture WHERE a user is logging into.

I get an awful lot of information about each user login and session, but I want to see which device they are connecting to.

Any ideas? is it an event ID that I can switch on?

Thanks