This is a problem in any environment, in or out of VDI. I use a simple command or two in the Windows AD login script, which runs on the VDI desktop each time a user logs in, to record the time, date, user name and machine name, to a text file on a hidden share.
Something like this in your Windows login script will write out a single master log file.
echo %DATE% - %TIME% - %USERNAME% logged into %COMPUTERNAME% >> \\shareserver\hiddenshare$\login_log.txt
EVEN MORE USEFUL:
You can also write a separate log file for every machine name, which records the user logging in, and vice versa for the users.
This line will create a text file for each VDI machine, and the contents of each file will be the username with timestamp of each login:
echo %DATE% - %TIME% - %USERNAME% logged in >> \\shareserver\hiddenshare$\%COMPUTERNAME%.txt
This line will write a logfile for each user, and record the machines they log into.
echo %DATE% - %TIME% - logged into %COMPUTERNAME% >> \\shareserver\hiddenshare$\%USERNAME%.txt
We have been doing these simple logs for years, and let me tell you that having these logs is hugely helpful in the day to day life of helpdesk and admin folks, for all manner of reasons.
The users must have modify access to the hidden share, therefore it is not secure enough for some organizations and probably shouldn't be used to prove a murder case either. But in most environments the information recorded is benign enough, and the benefits are many.
).