Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying to validate if anyone besides me actually logged on (i.e. if user/pass is compromised).


Neal Walters


Look in the Security Event Log for a Logon/Logoff Event 528, Logon Type 10

You can also setup an Audit Policy using the Group Policy editor to log logon success and failures. Go to Run and type gpedit.msc

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit logon events. Right click and select properties. Configure as you like.

  • On Win 2003 - this was found in "Admin Tools" - "Local Security Settings" - then in MMC Uunder "Local Policies", "Audit Policy" then on the right "Audit account logon events". Is there any way to get IP Address of Remote desktop users? Mar 12 '10 at 4:02
  • @NealWalters: Yes. In the text of the Event ID 528\Type 10 log entry you'll see the Source Network Address. This is the ip address that the client connected from. Note that this is the public ip address the client connection came from and is going to be the public ip address that the client's internal ip address is being NAT'ed to. You won't see the client's internal ip address in the log, but you can see it on the information tab when viewing a users connection in TS manager.
    – joeqwerty
    Mar 12 '10 at 4:34
  • More information from Microsoft: technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx Jul 28 '14 at 14:27

If you don't already have account logon events audited, then turning it on is not going to help you determine who has logged on to the server already. Turning on account logon auditing will help you in the future.

As far as RDP connections are concerned, there's no specific logging for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.