Are there any RDP activity logs? - Windows Server 2008 R2

Question

a few users have logged into a server through RDP.

I would like to monitor activity, but do not know my way round Windows Server that well.

I am hoping there are logs of some kind around that I can consult.

---

Any ideas? :)

Answer 1

A few options..

1. Basic windows logging using the policy setting "Audit Logon Events" should cover your needs.
2. You can also use a Remote Desktop Gateway and configure auditing that logs which users are accessing which internal resources via RDP. Some additional information is available here.
3. SecureRDP has detailed logging that outputs to .CSV format. SecureRDP is now offered for free.

Answer 2

Open Event Viewer and go to Applications and Services Logs\Microsoft\Windows\TerminalServices-LocalSessionManager then open up Admin or Operational under that view. You will see the sessions list. Date/Timestamped/IP/UserName etc. You can also look under Applications and Services Logs\Microsoft\Windows\TerminalServices-RemoteConnectionManager

Answer 3

You can have a look here. It's for Windows XP but most of it is still valid. http://theillustratednetwork.mvps.org/RemoteDesktop/RemoteDesktopSetupandTroubleshooting.html

Answer 4

You can set any user account in AD for remote control to view or interact with a user's session by going to the Users tab in Task Manager, right clicking and select 'Remote Control'. You can then view their session.

Answer 5

Disclaimer: I work for Acceleratio.

You can use Terminal Services Log to track user activity on the server for everybody who connected through the RDP protocol.

You can check out user activity at: TSL User Activities