Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I understand from log events if a user has connected to the remote desktop and when ? I have an AD 2003 environment and I would like to know when a certain user has connect to remote desktop service.

share|improve this question
    
Remote desktop service of the DC? Or of another server? –  Chris S Jul 29 '13 at 14:03
    
it's another server. –  Luigi Jul 29 '13 at 14:14
add comment

1 Answer

up vote 1 down vote accepted

On the Domain Controller(s), configure the Policy: Policies > Windows Settings > Security Settings > Local Policies > Audit Policy >Audit account logon events to Enabled, Success. Do this with a group policy object assigned to the Domain Controllers organization unit of the domain.

Once the DCs have updated their policy (you can force them with gpupdate) an event will be generated in the Security log for every successful logon. Within the event, it will list the Account Name (ie, the username), along with the Source Network Address (IP of the workstation). It will sometimes fill in additional fields depending on the logon type, but those two are reliable.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.