Are there any RDP activity logs? - Windows Server 2008 R2

Question

a few users have logged into a server through RDP.

I would like to monitor activity, but do not know my way round Windows Server that well.

I am hoping there are logs of some kind around that I can consult.

---

Any ideas? :)

Answer 1

A few options..

1. Basic windows logging using the policy setting "Audit Logon Events" should cover your needs.
2. You can also use a Remote Desktop Gateway and configure auditing that logs which users are accessing which internal resources via RDP. Some additional information is available here.
3. SecureRDP has detailed logging that outputs to .CSV format. SecureRDP is now offered for free.

Answer 2

You can have a look here. It's for Windows XP but most of it is still valid. http://theillustratednetwork.mvps.org/RemoteDesktop/RemoteDesktopSetupandTroubleshooting.html

Answer 3

you can set any user account in AD for remote control to view or interact with a users session by going to the users tab in task manager right clicking and select remote control...you can view their session.

Answer 4

Open Event Viewer and go to Applications and Services Logs\Microsoft\Windows\TerminalServices-LocalSessionManager then open up Admin or Operational under that view. You will see the sessions list. Date/Timestamped/IP/UserName etc. You can also look under Applications and Services Logs\Microsoft\Windows\TerminalServices-RemoteConnectionManager