Environment: Windows Server 2008 R2 with Samba 3.5 domain & OpenLDAP backend.
Background: on our previous Terminal Server (Windows Server 2003) we used logon/logoff scripts to log user logins and logouts respectively to plain text files on a network drive. Unfortunately we couldn't capture the remote IP address, only the workstation name.
Now that we're moving to Server 2008, we've discovered that the Event Log captures a huge amount of data - including the remote IP - but there doesn't seem to be an easy way to get the data that we want in the format that we want.
There are several resources that might be a step in the right direction:
My question is: do I try and get some sort of real-time export of events in human readable form (and how), or do I perform periodic parsing via a scheduled task (and how)?