Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I understand from log events if a user has connected to the remote desktop and when ? I have an AD 2003 environment and I would like to know when a certain user has connect to remote desktop service.

share|improve this question
Remote desktop service of the DC? Or of another server? – Chris S Jul 29 '13 at 14:03
it's another server. – Luigi Jul 29 '13 at 14:14
up vote 1 down vote accepted

On the Domain Controller(s), configure the Policy: Policies > Windows Settings > Security Settings > Local Policies > Audit Policy >Audit account logon events to Enabled, Success. Do this with a group policy object assigned to the Domain Controllers organization unit of the domain.

Once the DCs have updated their policy (you can force them with gpupdate) an event will be generated in the Security log for every successful logon. Within the event, it will list the Account Name (ie, the username), along with the Source Network Address (IP of the workstation). It will sometimes fill in additional fields depending on the logon type, but those two are reliable.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.