5

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying to validate if anyone besides me actually logged on (i.e. if user/pass is compromised).

Thanks,

Neal Walters

Improve this question

2 Answers 2

Reset to default
6

Look in the Security Event Log for a Logon/Logoff Event 528, Logon Type 10

You can also setup an Audit Policy using the Group Policy editor to log logon success and failures. Go to Run and type gpedit.msc

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit logon events. Right click and select properties. Configure as you like.

Improve this answer
3
  • On Win 2003 - this was found in "Admin Tools" - "Local Security Settings" - then in MMC Uunder "Local Policies", "Audit Policy" then on the right "Audit account logon events". Is there any way to get IP Address of Remote desktop users?
    – NealWalters
    Mar 12, 2010 at 4:02
  • @NealWalters: Yes. In the text of the Event ID 528\Type 10 log entry you'll see the Source Network Address. This is the ip address that the client connected from. Note that this is the public ip address the client connection came from and is going to be the public ip address that the client's internal ip address is being NAT'ed to. You won't see the client's internal ip address in the log, but you can see it on the information tab when viewing a users connection in TS manager.
    – joeqwerty
    Mar 12, 2010 at 4:34
  • More information from Microsoft: technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx
    – Nathan Hartley
    Jul 28, 2014 at 14:27
1

If you don't already have account logon events audited, then turning it on is not going to help you determine who has logged on to the server already. Turning on account logon auditing will help you in the future.

As far as RDP connections are concerned, there's no specific logging for that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .