Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server?

The closest Event Viewer logs I can find are under Application and Services Logs --> Microsoft --> Windows --> TerminalServices-RemoteConnectionManager. These logs are good, however you cannot display the user account for each login event (Event ID 1149).

Any ideas out there?

share|improve this question
I'm interested in that too - would like to be able to keep a good history of which server they were logged onto. Windows Event log are a bit hard to query from my experience! – ETL Feb 15 '13 at 2:02
@ETL: what's hard about querying the event log? I've done it in Batch (using an external tool) in PowerShell, VBScriptm JScript and in PHP, Perl and Python over the years. What exactly is "hard" about it? – 0xC0000022L Feb 15 '13 at 2:44
I take that back :) – ETL Feb 15 '13 at 4:29
Any sample scripts anyone could recommend to extract this data from the Event Viewer? – Ash Feb 17 '13 at 23:09

3 Answers 3

First off, if you didn't log it at the time (or the log has since been overwritten), you're out of luck.

Secondly, you want to look in the Security Event Log, and look for Event ID 528 and 540. Logon type 10 indicates a remote interactive logon (RDP).

share|improve this answer
The Security log does have logon & logoff events, however saving this report with all columns to a CSV file does not show the username for each log. The "User" column is empty. Here is an example CSV screenshot: – Ash Feb 17 '13 at 23:07
@Ash Not the right Event IDs there. – HopelessN00b Feb 18 '13 at 12:58

You can use a script to collect this information. Not as ideal/simple, but it will get the job done. Here is a Powershell script that should work on Windows 7/Server 2008r2 or higher (this code can be further cleaned up on newer Powershell versions, but I have kept it as-is for backwards compatibility):

$LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
$Results = @()
$Events = Get-WinEvent -LogName $LogName
foreach ($Event in $Events) {
    $EventXml = [xml]$Event.ToXML()

    $ResultHash = @{
        Time        = $Event.TimeCreated.ToString()
        'Event ID'  = $Event.Id
        'Desc'      = ($Event.Message -split "`n")[0]
        Username    = $EventXml.Event.UserData.EventXML.User
        'Source IP' = $EventXml.Event.UserData.EventXML.Address
        'Details'   = $Event.Message

    $Results += (New-Object PSObject -Property $ResultHash)

$Results | Export-Csv 'Remote Desktop Users.csv'
share|improve this answer

In reply to your problem regarding user account login events, Acceleratio’s SysKit does the trick.
You can view Security Log Reports, and then go to Logon Audit Reports to configure the reports. We extract this through the RDP protocol and from the security event log as well.

For more info, check out this link: Please note, I work for Acceleratio.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.