Hi ,

I want Logon and Logoff Alerts while any user login through RDP..

Please suggest Which Event ID i have to

You should be seeing this in 'eventvwr'. Under "Windows Logs --> Security".

4624 - Log In and 4634 - Log

Hi  SK,

For Server 2008 and above i used event id 21 -for Remote Logon and 23 - for remote Logoff. such Event Collection rule working in SCOM , we are getting the Logon and Logoff events in SCOM.. Log name i used in Event Collection rule is Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

But for Server 2003 i am unable to find such remote logon and Remote logoff Event IDs , please suggest how can i got the events while Remote Logon and Logoff server 2003 OS.

Hi Sir,

Please refer to following article  (event ID  538 ,528 ):

https://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

Best Regards,

El

i have created the Event Collection rule in SCOM with Event ID 528 and 538 and Logon type 10.

thats resolved my issue