Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying to validate if anyone besides me actually logged on (i.e. if user/pass is compromised).

Thanks,

Neal Walters

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

Look in the Security Event Log for a Logon/Logoff Event 528, Logon Type 10

You can also setup an Audit Policy using the Group Policy editor to log logon success and failures. Go to Run and type gpedit.msc

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit logon events. Right click and select properties. Configure as you like.

share|improve this answer
    
On Win 2003 - this was found in "Admin Tools" - "Local Security Settings" - then in MMC Uunder "Local Policies", "Audit Policy" then on the right "Audit account logon events". Is there any way to get IP Address of Remote desktop users? –  NealWalters Mar 12 '10 at 4:02
    
@NealWalters: Yes. In the text of the Event ID 528\Type 10 log entry you'll see the Source Network Address. This is the ip address that the client connected from. Note that this is the public ip address the client connection came from and is going to be the public ip address that the client's internal ip address is being NAT'ed to. You won't see the client's internal ip address in the log, but you can see it on the information tab when viewing a users connection in TS manager. –  joeqwerty Mar 12 '10 at 4:34
add comment

If you don't already have account logon events audited, then turning it on is not going to help you determine who has logged on to the server already. Turning on account logon auditing will help you in the future.

As far as RDP connections are concerned, there's no specific logging for that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.