2

i have several servers (VMs, if it makes any difference) running windows 2003 and 2008 server and multiple users that may be logged on to any of those servers at any given time. is it possible to somehow write user logon/logoff events to a log file in windows 2003 and 2008 servers so that i could keep track of it?

thanks.

EDIT - i'd also like to know where (as in ip/hostname) the connections are coming from

Improve this question

1 Answer 1

Reset to default
6

They already are (or should be) logged to the Security log.

Event IDs 528 and 540 indicate a user logon, with type 10 indicating a terminal server/remote desktop session.

Event 551 indicates a logoff, whereas Event 4779 indicates a disconnection, rather than a proper logoff.

(All Security Log events.)

Parsing the event log for these events can frankly be a pain in the ass, but at least under 2008, the improved log viewer makes it much easier to filter the EventLog to only show the events you want. Still (and given that you have 2003 servers), it might be worth your time to punch up a Powershell script to parse those values for you... or pay for quality log analyzing/aggregating software.

Below is an example of the log dialogue box you'd see in 2003, though you'd probably want to parse and extract the relevant information into a text format somewhere (which is [relatively] easy with PowerShell).

enter image description here

Improve this answer
3
  • can i also tell where the connections are coming from, not only what credentials they were using?
    – radai
    Jul 24, 2012 at 13:21
  • @radai I am pretty sure that is also written in the logon log.
    – Frederik
    Jul 24, 2012 at 13:24
  • @radai Frederik is correct. That information's contained in the EventLog entry. Gimmie a minute and I'll find a sample entry I can sanitize and edit into my answer.
    – HopelessN00b
    Jul 24, 2012 at 14:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .