Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine?
We have a server here in our intranet which has a domain-wide user as local admin and when I logged in with its credentials yesterday, I saw .. well.. something rather "unpleasant" going on in the already existing session and I'd like to find out who was the one connecting and using that account/session before me.. who being any sort of information that might help tracking down who he actually was - e.g. machine name the login/session was initiated from etc. Is there any way to retrieve any helpful information?
I am not an admin and the IT department takes a while to respond, but we want to stop that user/behaviour asap without 'just' changing the pw etc.