i have several servers (VMs, if it makes any difference) running windows 2003 and 2008 server and multiple users that may be logged on to any of those servers at any given time. is it possible to somehow write user logon/logoff events to a log file in windows 2003 and 2008 servers so that i could keep track of it?


EDIT - i'd also like to know where (as in ip/hostname) the connections are coming from


They already are (or should be) logged to the Security log.

Event IDs 528 and 540 indicate a user logon, with type 10 indicating a terminal server/remote desktop session.

Event 551 indicates a logoff, whereas Event 4779 indicates a disconnection, rather than a proper logoff.

(All Security Log events.)

Parsing the event log for these events can frankly be a pain in the ass, but at least under 2008, the improved log viewer makes it much easier to filter the EventLog to only show the events you want. Still (and given that you have 2003 servers), it might be worth your time to punch up a Powershell script to parse those values for you... or pay for quality log analyzing/aggregating software.

Below is an example of the log dialogue box you'd see in 2003, though you'd probably want to parse and extract the relevant information into a text format somewhere (which is [relatively] easy with PowerShell).

enter image description here

| improve this answer | |
  • can i also tell where the connections are coming from, not only what credentials they were using? – radai Jul 24 '12 at 13:21
  • @radai I am pretty sure that is also written in the logon log. – Frederik Nielsen Jul 24 '12 at 13:24
  • @radai Frederik is correct. That information's contained in the EventLog entry. Gimmie a minute and I'll find a sample entry I can sanitize and edit into my answer. – HopelessN00b Jul 24 '12 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.