Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server?

The closest Event Viewer logs I can find are under Application and Services Logs --> Microsoft --> Windows --> TerminalServices-RemoteConnectionManager. These logs are good, however you cannot display the user account for each login event (Event ID 1149).

Any ideas out there?

share|improve this question
    
I'm interested in that too - would like to be able to keep a good history of which server they were logged onto. Windows Event log are a bit hard to query from my experience! –  ETL Feb 15 '13 at 2:02
    
@ETL: what's hard about querying the event log? I've done it in Batch (using an external tool) in PowerShell, VBScriptm JScript and in PHP, Perl and Python over the years. What exactly is "hard" about it? –  0xC0000022L Feb 15 '13 at 2:44
    
I take that back :) –  ETL Feb 15 '13 at 4:29
    
Any sample scripts anyone could recommend to extract this data from the Event Viewer? –  Ash Feb 17 '13 at 23:09

1 Answer 1

First off, if you didn't log it at the time (or the log has since been overwritten), you're out of luck.

Secondly, you want to look in the Security Event Log, and look for Event ID 528 and 540. Logon type 10 indicates a remote interactive logon (RDP).

share|improve this answer
    
The Security log does have logon & logoff events, however saving this report with all columns to a CSV file does not show the username for each log. The "User" column is empty. Here is an example CSV screenshot: bit.ly/YgZfhu –  Ash Feb 17 '13 at 23:07
    
@Ash Not the right Event IDs there. –  HopelessN00b Feb 18 '13 at 12:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.