is there a way to get a log of all users accessed the windows2008 r2 server remotely
we need to know their machine IP from what time to what time they have accessed the server ?
These events are recorded in the Security event-log. Event ID 4846. Logout events are ID 4634. You can correlate login events with logout events through the LogonGUID attribute on both events.
Windows doesn't provide a way to generate a list with these, you'll have to write something or buy something to do it.
There are several ways: 1. Using free software http://technet.microsoft.com/en-us/magazine/2005.05.utilityspotlight.aspx also keep track of all logins information in Active Directory domains
2.Using paid monitoring software: terminalserviceslog.com
3.Using login script You can add some lines to the logon and log off script to write something to the server share log file.
@echo off echo [%date% %time%] >>\server\share\logtime.log echo %username% log on %computername% to domain: %userdomain% >>\server\share\logon.log