Log remote username when logging into RDP

Question

Is there a way to log the remote username when logging into a win2003 or win2008 (r1 or r2) server.

The application must run in a console window as opposed to running as a service so a user has to remain logged in to use it, and the various members of the ops team are able to login as that user to troubleshoot/diagnose any issue's. We would like to be able to audit who logged in and performed what changes to the system, however windows is only logging that the service account logged in, and not the remote user.

I know services like RADMIN will log the remote username, but it has issues of it's own such as only logging into the console session.

Answer 1

There is not much you can do there, most of it is pretty tedious. The TS will keep information about the client computer's name after login - this information goes to the CLIENTNAME environment variable. You could use this information along with the timestamp to either

a) query your domain controller's security log until you find out who was logged in at this very client during the particular time period (which would involve parsing very large volumes of logs) or

b) execute psloggedon or some variant using the same method back from the TS to the %CLIENTNAME% machine immediately to learn about the user name in the interactive logon

The latter obviously requires a working RPC connection / remote registry access to the client and both will require a privileged operation that you probably will need to trigger with administrative rights.

Answer 2

You can use logon and logoff scripts (can be local, rather than domain scripts) to record who and when, as well as from where if it's an RDP session. As for what they do while logged on, that's something not so easy to do and will need a programmatic solution, which is outside the scope of SF.