Dear all,

In event viewer of windows server 2008 R2, remote desktop connection log shown source IP address.

But in windows server 2012, remote desktop connection log have source IP address shown blank. I didn't found any source IP address data.

Can anyone please help me how can i get source IP address information when log in the server remotely.

also is there any way to get email notification when remotely log in to the server.

Please suggest as soon as possible.

Thanks,

Parvez

• Edited by Parvez Islam 27 minutes ago

Hi Parvez,

Here for your issue, I can suggest that you can track the events in event viewer. You can track the Event ID 4624 & 4625 in Security log. If the logon successful you can get information from 4624 and if the logon fails then form 4625. For detail description regarding both event you can refer below link.

4624: An account was successfully logged on
4625: An account failed to log on

Hope it helps!
Regards.

Hey Parvez,

The correct event log you should be looking for is

Applications & Services log -> Microsoft -> Windows -> TerminalServices-RemoteConnectionManager -> Operational

This log logs eventid 1149 whenever a user logs on successfully and it logs the client's IP address as well:

Example:

Remote Desktop Services: User authentication succeeded:

User: jklaas

Domain: itw

Source Network Address: 192.168.66.21

As for you question on email whenever a user logs on, this is easily done by Right-clicking event 1149 in that log and attaching a task. Configure the task to send an email.

Cheers

Arjan

• Proposed as answer by Arjan Mensch Thursday, January 02, 2014 12:23 PM
• Marked as answer by Dharmesh SMicrosoft contingent staff, Moderator Tuesday, January 07, 2014 3:41 AM

Hi Parvez,

Do you need any other assistance? If there is anything we can do for you, please let us know.

Thanks.

Dear ALL,

The Below location was not show the source network address. 

Applications & Services log -> Microsoft -> Windows -> TerminalServices-RemoteConnectionManager -> Operational

Please see the screenshot. Here Source Network address is blank. Please suggest .

• Edited by Parvez Islam 28 minutes ago