Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have several servers (VMs, if it makes any difference) running windows 2003 and 2008 server and multiple users that may be logged on to any of those servers at any given time. is it possible to somehow write user logon/logoff events to a log file in windows 2003 and 2008 servers so that i could keep track of it?


EDIT - i'd also like to know where (as in ip/hostname) the connections are coming from

share|improve this question

They already are (or should be) logged to the Security log.

Event IDs 528 and 540 indicate a user logon, with type 10 indicating a terminal server/remote desktop session.

Event 551 indicates a logoff, whereas Event 4779 indicates a disconnection, rather than a proper logoff.

(All Security Log events.)

Parsing the event log for these events can frankly be a pain in the ass, but at least under 2008, the improved log viewer makes it much easier to filter the EventLog to only show the events you want. Still (and given that you have 2003 servers), it might be worth your time to punch up a Powershell script to parse those values for you... or pay for quality log analyzing/aggregating software.

Below is an example of the log dialogue box you'd see in 2003, though you'd probably want to parse and extract the relevant information into a text format somewhere (which is [relatively] easy with PowerShell).

enter image description here

share|improve this answer
can i also tell where the connections are coming from, not only what credentials they were using? – radai Jul 24 '12 at 13:21
@radai I am pretty sure that is also written in the logon log. – Frederik Nielsen Jul 24 '12 at 13:24
@radai Frederik is correct. That information's contained in the EventLog entry. Gimmie a minute and I'll find a sample entry I can sanitize and edit into my answer. – HopelessN00b Jul 24 '12 at 14:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.