How do I determine when I see Scecli 1704 on my server event viewer whether or not this represents remove access to the server? How can I identify the remote user

Hi, Sorry but I do not understand your question. The event SceCli 1704 is used to indicate that the security policy was applied successfully. http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1704&EvtSrc=SceCliThis posting is provided "AS IS" with no warranties, and confers no rights.