Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to to retrieve an audit trail / history of remote/rdp logons for a particular user on a Windows 2008 R2 machine?

We have a server here in our intranet which has a domain-wide user as local admin and when I logged in with its credentials yesterday, I saw .. well.. something rather "unpleasant" going on in the already existing session and I'd like to find out who was the one connecting and using that account/session before me.. who being any sort of information that might help tracking down who he actually was - e.g. machine name the login/session was initiated from etc. Is there any way to retrieve any helpful information?

I am not an admin and the IT department takes a while to respond, but we want to stop that user/behaviour asap without 'just' changing the pw etc.

share|improve this question
up vote 0 down vote accepted

You should be able to find the IP address of the connecting machine in the Security log. Open the event viewer program on the server, then check the security log (under the Windows Logs folder).

On the right hand side, select filter and filter for event ID 4624. You'll have to look through the events until you find ones that have 'Logon type: 10'. Those will show the IP address of the connecting machine as 'Source Network Address'.

You can check the machine name by opening a command prompt and typing nslookup IPAddress (example: nslookup Note that depending on your network configuration, the IP address you find in the log may have been reassigned to a new machine, so this may not be accurate after the event occurred.

The IP (or machine name) may also show up in the Operations log in the event veiwer under the folder path "Application and Services Logs\Microsoft\Windows\TerminalServices-RemoteConnectionManager". Look for EventID 1149.

share|improve this answer
In addition, use named accounts for each user. Do not use the same "domain wide" account for every user that logs on to this server. – joeqwerty Apr 28 '13 at 1:13
@joeqwerty that's what we & company policy tells folks to do, everything else means trouble. There are just very few domain wide accounts that are not named accounts & those who are allowed to use them are an even more select (and named) group of people but none of those was the one initiating/working under that session mentioned above, hence I want to find out who it was. – Jörg B. Apr 28 '13 at 9:29
that worked - thanks! @matt – Jörg B. May 1 '13 at 19:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.