I think we cover your first question , now let see the other questions,
3) can I have any disconnect attempts trapped and an e-mail sent to a specific e-mail account - we have Exchange running on the system - when somebody has disconnected/tried to disconnect
yes you can I close my session using the X on the bar ,an event id 683 was generated (see picture), you can use eventrigers.exe utility to capture (track) this event and send it by email.
here is the tutorial
http://www.petri.co.il/how-to-use-eventtriggersexe-to-send-e-mail-based-on-event-ids.htmRegards,