Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to log the remote username when logging into a win2003 or win2008 (r1 or r2) server.

The application must run in a console window as opposed to running as a service so a user has to remain logged in to use it, and the various members of the ops team are able to login as that user to troubleshoot/diagnose any issue's. We would like to be able to audit who logged in and performed what changes to the system, however windows is only logging that the service account logged in, and not the remote user.

I know services like RADMIN will log the remote username, but it has issues of it's own such as only logging into the console session.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

There is not much you can do there, most of it is pretty tedious. The TS will keep information about the client computer's name after login - this information goes to the CLIENTNAME environment variable. You could use this information along with the timestamp to either

a) query your domain controller's security log until you find out who was logged in at this very client during the particular time period (which would involve parsing very large volumes of logs) or

b) execute psloggedon or some variant using the same method back from the TS to the %CLIENTNAME% machine immediately to learn about the user name in the interactive logon

The latter obviously requires a working RPC connection / remote registry access to the client and both will require a privileged operation that you probably will need to trigger with administrative rights.

share|improve this answer
    
A) seems to be out of the question for the OPS team, but b) seems promising. My quick test shows that I cant get the remote registry through the data center firewall, but I will have to check on that with the network team. I may be able to convince them to have a single jump point to login to first with my domain account then login into the second with the service account. That way the remote registry call shouldn't be a worry. Thanks for the help! –  Tristan Jun 17 '11 at 18:51

You can use logon and logoff scripts (can be local, rather than domain scripts) to record who and when, as well as from where if it's an RDP session. As for what they do while logged on, that's something not so easy to do and will need a programmatic solution, which is outside the scope of SF.

share|improve this answer
    
+1 - Seen this done quite a few times (the first part, that is) –  Mark Henderson Jun 17 '11 at 1:21
    
Thanks, I don't need anything extra for logging what they do, just who is doing it. –  Tristan Jun 17 '11 at 18:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.