Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is there a way to get a log of all users accessed the windows2008 r2 server remotely

we need to know their machine IP from what time to what time they have accessed the server ?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

These events are recorded in the Security event-log. Event ID 4846. Logout events are ID 4634. You can correlate login events with logout events through the LogonGUID attribute on both events.

Windows doesn't provide a way to generate a list with these, you'll have to write something or buy something to do it. wevtutil provides a way of querying the event-log and dumping it to a text file for processing with a script.

share|improve this answer
2  
Note 1. logon/off events are not logged by default: use secpol.msc (or GP) to enable. 2. PowerShell's Get-WinEvent allows remote access to filter and read event logs, including all the processing and saving PSH can then do; see here for starting on that cmdlet. –  Richard Jan 26 '11 at 10:32

There are several ways: 1. Using free software http://technet.microsoft.com/en-us/magazine/2005.05.utilityspotlight.aspx also keep track of all logins information in Active Directory domains

2.Using paid monitoring software: terminalserviceslog.com

3.Using login script You can add some lines to the logon and log off script to write something to the server share log file.

@echo off echo [%date% %time%] >>\server\share\logtime.log echo %username% log on %computername% to domain: %userdomain% >>\server\share\logon.log

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.