I agree, LSPush is what you'd want to use on a logon script... it processes WMI locally on the machine, and shoots over about 20 to 30KB depending on how much event logs you scan for... so its actually less network traffic than a normal scan from the scanning server to the asset. It will give you the logon history for the most part... it won't catch logons off the network or off VPN (it will just fail because it can't reach the server) unless you open up a listener from the DMZ or border/edge... which I haven't vuln scanned that option...
I generally use an active directory audit application like ADAudit, etc... to make sure I catch the most that I can... but I digress.
LSPush, yes. 🙂