Here's what I would use:
First, create a User Defined Group like this one:
Image may be NSFW.
Clik here to view.
Then, in your rule for logins, make is something like this:
Image may be NSFW.
Clik here to view.
(This is an awful rule, you'd probably want some NOT statements to trim out the Windows NTSYSTEM accounts and other corporate accounts that legitimately are going to login to lots of machines at once)
Then your LogOff Rule would look like:
Image may be NSFW.
Clik here to view.
(Again, awful for [see previous reasons])
And the rule in the middle would be something like:
