We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)?

Windows Server 2003 AD Domain

1 Answer 1


Audit Logon Events So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server.

To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a descriptive name. Audit_Remote_logons seems good enough for me. Then go "Computer Configuration --> Policies --> Windows Settings --> Security --> Local Policy --> Audit Policy --> Then open Audit Logon Events and then enable "Success" and "Failure"

Now link the GPO the the OUs you want this enabled for.

Optionally, run "GPUdate /force" on your production servers. After this policy has been applied you can go into your security events logs and view the successful logon/logoff events.

  • I took dunxd advice and answered my own question.
    – Jake
    Aug 6, 2012 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.