20

a few users have logged into a server through RDP.

I would like to monitor activity, but do not know my way round Windows Server that well.

I am hoping there are logs of some kind around that I can consult.


Any ideas? :)

  • the windows log file does not show unsuccesful attempts, by the way. Use a firewall to show unsuccessful attempts to RDP. Just saying. – not_a_friend Aug 7 at 20:13
6

A few options..

  1. Basic windows logging using the policy setting "Audit Logon Events" should cover your needs.
  2. You can also use a Remote Desktop Gateway and configure auditing that logs which users are accessing which internal resources via RDP. Some additional information is available here.
| improve this answer | |
32
  1. Open Event Viewer (eventvwr.msc)
  2. Go to to Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager
  3. Open Admin or Operational

You will see the sessions list. Date/Timestamped/IP/UserName etc. You can also look under Applications and Services Logs\Microsoft\Windows\TerminalServices-RemoteConnectionManager

| improve this answer | |
  • The client IP (Source Network Address) is blank for me on Windows Server 2012. How do you enable it? – Sacha K Feb 12 '15 at 13:09
  • 1
    I wrote up a tool that parses the Event viewer for you and shows you a history of logins. You can grab the tool from my blog: uglyvpn.com/2015/09/25/… – nGX Oct 21 '15 at 20:31
  • KPS, you posted deadlink – Steve Yakovenko Jul 21 '18 at 12:55
3

Here's a solution in PowerShell:

Get-EventLog -LogName Security | ?{(4624,4778) -contains $_.EventID} | %{
    (new-object -Type PSObject -Property @{
        TimeGenerated = $_.TimeGenerated
        ClientIP = $_.Message -replace '(?smi).*Source Network Address:\s+([^\s]+)\s+.*','$1'
        UserName = $_.Message -replace '(?smi).*Account Name:\s+([^\s]+)\s+.*','$1'
        UserDomain = $_.Message -replace '(?smi).*Account Domain:\s+([^\s]+)\s+.*','$1'
        LogonType = $_.Message -replace '(?smi).*Logon Type:\s+([^\s]+)\s+.*','$1'
    })
} | sort TimeGenerated -Descending | Select TimeGenerated, ClientIP `
, @{N='Username';E={'{0}\{1}' -f $_.UserDomain,$_.UserName}} `
, @{N='LogType';E={
    switch ($_.LogonType) {
        2   {'Interactive (logon at keyboard and screen of system)'}
        3   {'Network (i.e. connection to shared folder)'}
        4   {'Batch (i.e. scheduled task)'}
        5   {'Service (i.e. service start)'}
        7   {'Unlock (i.e. post screensaver)'}
        8   {'NetworkCleartext (i.e. IIS)'}
        9   {'NewCredentials (i.e. local impersonation process under existing connection)'}
        10  {'RemoteInteractive (i.e. RDP)'}
        11  {'CachedInteractive (i.e. interactive, but without network connection to validate against AD)'}   
        default {"LogType Not Recognised: $($_.LogonType)"}     
    }
}} 

Information on the related EventIds we're filtering on can be found here:

For RDP connections you're specifically interested in LogType 10; RemoteInteractive; here I've not filtered in case the other types are of use; but it's trivial to add another filter if required.

You'll also need to ensure these logs are created; to do that:

  • Click Start
  • Select Control Panel
  • Select Administrative Tools
  • Open Local Security Policy
  • Navigate Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Logon/Logoff
  • Amend Audit Logon to Success
| improve this answer | |
2

Other than combing through the event logs, looking for Logon Type 10 (Remote Desktop) in the Security Log, or looking at the TerminalServices channel event logs, you'll need to use third party software.

In addition to TSL mentioned above, here is one other I've used with success in the past - Remote Desktop Reporter

http://www.rdpsoft.com/products

If you go third party, make sure you evaluate several and get price quotes from each vendor ... there is a huge discrepancy in price - some vendors price per named user, some per concurrent user, and some simply by server. Make sure also that the solution comes with its own database or a lite version of SQL - otherwise you'll get hit with database license costs as well.

| improve this answer | |
0

You can set any user account in AD for remote control to view or interact with a user's session by going to the Users tab in Task Manager, right clicking and select 'Remote Control'. You can then view their session.

| improve this answer | |
0

I've been through most of the free/affordable answers on this page as well as searching elsewhere (for days, including reading the Event logs mentioned by Andy Bichler) and here's an alternate free RDP monitoring and blocking tool:

http://www.tweaking.com/content/page/remote_desktop_ip_monitor_blocker.html

I haven't tested it extensively, but downloaded and scanned it (the portable version) and although the UI is a bit on the ugly side, it's working on a 2012 R2 server without issue thus far. It's "hands on," but a no-brainer as well and beats deciphering the event logs.

There is also ts_block which allows you to automatically block IPs that are brute forcing your server's RDP (which I'm guessing would have some log of RDP attempts):

https://github.com/EvanAnderson/ts_block

As you can see in that link, the author is a serverfault user. I have not tested it as it's basically a vbscript that I would need to dissect before using. But, it seems promising.

The problem with the event logs mentioned by Andy above is that they are not very clear or descriptive as to who's doing what... at least in a malicious sense. You can find IP Addresses, but then it's hard to tell if they are related to all the unsuccessful login attempts. So, another tool other than the inherent logs seems almost mandatory if you're server is internet facing and you have any concerns about security.

| improve this answer | |
0

in the eventlog -

Applications and Services Logs\Microsoft\Windows\remote desktop services-rdpcorets

there is all attempts to connect to rdp and the ip address

| improve this answer | |
  • I can't see what exactly is the start and end of the file path. Some markup would make this answer a lot more readable. – kasperd Oct 24 '16 at 20:22
0

When I was working as an administrator few years back I had issue like you do now, I wanted to monitor everybody that connect via the RDP and exactly when and if they were active or idle.

I have evaluated few products but decided none of them is good enough for me so I built my own (the problem was every had some kind of an agent or service to collect the data, and the solution I built is using TS API to remotely to remote server and extract the data without any agent). The product is called now syskit (or TSL as Jim mentioned) and it is used widely all over the world :D

You can check user activities here

| improve this answer | |
0

Run this in Powershell:

Get-WinEvent -ProviderName OpenSSH | Export-Csv -Path 'C:\Users\Windows10\Desktop\SSHLogs.csv' -NoTypeInformation

Your SSH logs file in CSV is ready!

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.