Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As the title suggests, I'm trying to keep an eye on RDP connections / disconnections to a couple of machines. One's running Windows XP and one's running Windows 7.

I've checked the event logs on the Windows XP machine and there's nothing mentioned in there. Is it just a Windows 2003 Server feature?

share|improve this question
up vote 1 down vote accepted

I dont know if there's something specific for RDP, btw you could

  1. enable an Audit Policy for Logons on the workstation (you can do it via GPO if you're on a Active Directory domain or you can do it on a single workstation editing its Local Security Policy)
  2. check Events in Security with Event Code = 528 (User logged in) and Logon Type = 10 (Remote Interactive, so RDP like connections)

you can query Events i.e. using LogParser (GUI here) and maybe load them in a DB for future analysis

share|improve this answer
Thanks. I'm using Python to parse the loging messages as part of a larger suite of applications (no need to use logparser). – Jon Cage Apr 12 '10 at 9:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.