4

Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server?

The closest Event Viewer logs I can find are under Application and Services Logs --> Microsoft --> Windows --> TerminalServices-RemoteConnectionManager. These logs are good, however you cannot display the user account for each login event (Event ID 1149).

Any ideas out there?

Improve this question
4
  • I'm interested in that too - would like to be able to keep a good history of which server they were logged onto. Windows Event log are a bit hard to query from my experience!
    – ETL
    Feb 15, 2013 at 2:02
  • @ETL: what's hard about querying the event log? I've done it in Batch (using an external tool) in PowerShell, VBScriptm JScript and in PHP, Perl and Python over the years. What exactly is "hard" about it?
    – 0xC0000022L
    Feb 15, 2013 at 2:44
  • I take that back :)
    – ETL
    Feb 15, 2013 at 4:29
  • Any sample scripts anyone could recommend to extract this data from the Event Viewer?
    – Ash
    Feb 17, 2013 at 23:09

3 Answers 3

Reset to default
6

You can use a script to collect this information. Not as ideal/simple, but it will get the job done. Here is a Powershell script that should work on Windows 7/Server 2008r2 or higher (this code can be further cleaned up on newer Powershell versions, but I have kept it as-is for backwards compatibility):

$LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
$Results = @()
$Events = Get-WinEvent -LogName $LogName
foreach ($Event in $Events) {
    $EventXml = [xml]$Event.ToXML()

    $ResultHash = @{
        Time        = $Event.TimeCreated.ToString()
        'Event ID'  = $Event.Id
        'Desc'      = ($Event.Message -split "`n")[0]
        Username    = $EventXml.Event.UserData.EventXML.User
        'Source IP' = $EventXml.Event.UserData.EventXML.Address
        'Details'   = $Event.Message
    }

    $Results += (New-Object PSObject -Property $ResultHash)
}

$Results | Export-Csv 'Remote Desktop Users.csv'
Improve this answer
3
  • Solid for my usage with a few tweaks! Thanks much!
    – ATek
    Sep 8, 2016 at 16:03
  • Still works in 2019. I piped it to Out-GridViewto sort by different criteria on the fly. It treats the date like strings though, so the sorting works in clusters of similar dates.
    – user38537
    Jan 1, 2020 at 3:24
  • For anyone looking in 2020 - I built this snippet into a full script, added the ability to prompt for a computer, and tested with PowerShell 5 & 7: gist.github.com/thomasswilliams/…
    – thomasswilliams
    Aug 25, 2020 at 10:00
1

First off, if you didn't log it at the time (or the log has since been overwritten), you're out of luck.

Secondly, you want to look in the Security Event Log, and look for Event ID 528 and 540. Logon type 10 indicates a remote interactive logon (RDP).

Improve this answer
2
  • The Security log does have logon & logoff events, however saving this report with all columns to a CSV file does not show the username for each log. The "User" column is empty. Here is an example CSV screenshot: bit.ly/YgZfhu
    – Ash
    Feb 17, 2013 at 23:07
  • @Ash Not the right Event IDs there.
    – HopelessN00b
    Feb 18, 2013 at 12:58
1

Based on https://gallery.technet.microsoft.com/Log-Parser-to-Identify-8aac36bd

Get-Eventlog -LogName Security | where {$_.EventId -eq "4624"} | select-object @{Name="User"
;Expression={$_.ReplacementStrings[5]}} | sort-object User -unique

You can grab other info from ReplacementStrings. You can also specify a remote computer in the Get-Eventlog command.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .