I think it's all or nothing thing for audit user logins. Could be wrong though. There are so many random obscure options in the registry.

- Trevor