Terminal Sessions Log
I would like to monitor the users who is logging into the Win 2008 machines through RDP. Is there any log available?Thanks++ Madan
April 16th, 2012 11:59pm
Following article should help
How to turn on the Terminal Services Session Directory logging service
http://support.microsoft.com/kb/327508
The Terminal Services Session directory log file contains the following entries:
Session Directory service started
Session Directory service stopped
Machine joins session directory
Machine leaves session directory
User logs in
User disconnects
User reconnects
User logs out
Session Directory-related event log messages.
If it looks good, Eat it ! Likewise, If you don't know the answers, don't hesitate to ask questions !!
This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
About Me !!!
Free Windows Admin Tool Kit Click here and download it now
April 17th, 2012 12:38am
I didnt find the Terminal Services Session Directory logging service
MadanThanks++ Madan
April 17th, 2012 1:17am
Above mentioned article is for Terminal Servers. You won't find TS Session Directory Logging Service on non TS as far as I know.
check following article for event IDs
Remote Desktop Services Events in Windows Server 2008 R2
http://technet.microsoft.com/en-us/library/ff404148(v=ws.10).aspx
Thanks !
Free Windows Admin Tool Kit Click here and download it now
April 17th, 2012 1:35am
I didnt find the Terminal Services Session Directory logging service
Madan
Thanks++ Madan
I was referring to TS environment. Sorry, I wasnt clear in my response. If it looks good, Eat it ! Likewise, If you don't know the answers, don't hesitate to ask questions !!
This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
About Me !!!
April 17th, 2012 2:44am
Based on your description, I think you can enable the audit logon policy on the workstations. Then you can find the related events in Security Event log.
Refer to: Audit Logon events
http://technet.microsoft.com/en-us/library/cc787567(v=ws.10).aspx
Regards,
Miya
Miya Yao
TechNet Community Support
Free Windows Admin Tool Kit Click here and download it now
April 17th, 2012 3:14am
Based on your description, I think you can enable the audit logon policy on the workstations. Then you can find the related events in Security Event log.
Refer to: Audit Logon events
http://technet.microsoft.com/en-us/library/cc787567(v=ws.10).aspx
Regards,
Miya
Miya Yao
TechNet Community Support
April 17th, 2012 10:08am