Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work all day on a Windows Server 2003 machine and have noticed people "borrowing" my machine by using Remote Desktop to log in. This is pretty much "normal behaviour" at the company I work at, but I'd like to know when this is happening.

Is there any way I can be alerted each time someone remote desktop's onto my server? A simple "Bob has logged in" would be great - and I imagine there is a facility somewhere to enable this.

share|improve this question
add comment

migrated from superuser.com Dec 10 '09 at 16:53

This question came from our site for computer enthusiasts and power users.

5 Answers

up vote 2 down vote accepted

There are some good suggestions here - but I've taken the hard work out of it all by writing a remote access monitor tool. I've open sourced it in case anyone wants to use it / add to it.

http://remoteaccessmonitor.codeplex.com/

It examines the process list and alerts when a process is started by "another user" - so it works for all remote access types.

share|improve this answer
add comment

On the server, add a .bat file into the All Users -> Start Menu -> Startup folder.

In it add the line:

NET SEND yourpcname %username% logged into the server

You'll need to enable messenger on both machines. Assuming you have XP because I'm not sure you can receive messenger messages in Vista or 7.

share|improve this answer
add comment

Why not create a logon script for that server to send you an alert using whatever method you like, such as email, net send, etc.?

share|improve this answer
add comment

You can list the sessions on any terminal server using the built-in tool qwinsta and the correct credentials.

Script this to poll the status regularly and have it alert you with a popup or send you an IM or whatever you fancy and can script ^^

Add a login script to that machine either manually or by group policy that alerts you whenever someone logs on. It could be made to check if it's a remote session or not if that distinction is really needed.

Or use any tool available, I'd use whatever monitoring suite is in place, to monitor the event log which would also contain these logins - and have the suite alert you.

If it was a Windows 2008+ machine the event log itself could take action, if configured to, I think.

share|improve this answer
add comment

Terminal Services Manager (located in Administrative Tools) lists the connections made to a terminal server (includes computers with remote desktop for administration enabled, which is your situation).

It's an mmc snap in, so you wouldn't normally have it running but it will show you the connections (who and when, etc). I suppose if you have a very large desktop you could have it running in an unused part of the screen.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.