Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What traces leaves administrator (domain and local), when remotely connects to domain workstations? Domain server: Win2008 Std, workstations: WinXP, Win2007. Is there any traces in server event log? Is there some traces in workstations event log?

Edit: For example, user with domain admin rights from Workstation1 connects to Workstation2 (to hidden admin share c$). Will be events recorded on Workstation1? Workstation2? Active directory Server1?

Thanks for answers.

share|improve this question
I'm curious as to what the purpose of this question was. – Iszi Mar 29 '12 at 21:02
up vote 2 down vote accepted

Your statement "connects to" is a bit vague. I suspect you're talking about an Administrator using either built-in or third-party administration tools and not simple TCP connections to the clients.

There won't be a whole lot unless something was done. Simple TCP/IP access isn't logged by default. The main things you'd be looking for are changes to the filesystem and records in the event logs.

Most of the "traces" you're going to find would be in the Security Event Log. In a stock Windows XP machine there wouldn't be much of anything logged because, by default, no auditing was enabled in any version of Windows XP. On the Windows Server 2008 and Window 7 machines the defaults are expanded (though I don't have a reference handy at the moment) and I believe you'll see some successful access attempts, as well as failures, by default.

As an aside, "Audit Policy" is what you're looking for to configure computers to audit for this kind of thing in the future.

If there was an interactive logon then you'll have a slew of events in the Application Event log in any of those versions of Windows.

Depending on the level of auditing you've got enabled on your domain controllers you might see events in the Security Event Logs on those machines showing logon events to the client computers. A logon event would be generated any time an domain account was used to access a service that uses domain authentication on the client (built-in remote administration tools via RPC, connecting the file shares, interactive logons).

If the "Administrator" used a third-party tool ("LogMeIn", "VNC", etc) then there will probably be logs in the Application Event Log.

If the NTFS filesystem is configured with default settings the last access times on files will be "bumped", but you'll probably trash any evidence if you go bumbling around trying to look at that w/o taking precautions. Obviously, if any files were modified or created and steps weren't taken to cover the tracks then there will be creation and modification time changes, too.

In the scenario you describe in your question, depending on the OS versions at play, you might see events in the Security Event Logs on both the "Workstation 2" computer and the "Active directory Server1" showing the network logon events associated with the filesystem access. If "Workstation 2" is a Windows XP machine with stock settings then you'll see nothing there.

share|improve this answer

This is a bit too open ended but yes there will be events logged on the connected-to workstation/server.

share|improve this answer
Will be there some traces on AD server? For example, is there possibility to detect increased activity of some administrative account? – VikciaR Jul 4 '11 at 12:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.