Is it possible to generate a report of past user logins to a Windows Server 2008 Remote Desktop Services server?

The closest Event Viewer logs I can find are under Application and Services Logs --> Microsoft --> Windows --> TerminalServices-RemoteConnectionManager. These logs are good, however you cannot display the user account for each login event (Event ID 1149).

Any ideas out there?

  • I'm interested in that too - would like to be able to keep a good history of which server they were logged onto. Windows Event log are a bit hard to query from my experience! – ETL Feb 15 '13 at 2:02
  • @ETL: what's hard about querying the event log? I've done it in Batch (using an external tool) in PowerShell, VBScriptm JScript and in PHP, Perl and Python over the years. What exactly is "hard" about it? – 0xC0000022L Feb 15 '13 at 2:44
  • I take that back :) – ETL Feb 15 '13 at 4:29
  • Any sample scripts anyone could recommend to extract this data from the Event Viewer? – Ash Feb 17 '13 at 23:09

You can use a script to collect this information. Not as ideal/simple, but it will get the job done. Here is a Powershell script that should work on Windows 7/Server 2008r2 or higher (this code can be further cleaned up on newer Powershell versions, but I have kept it as-is for backwards compatibility):

$LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
$Results = @()
$Events = Get-WinEvent -LogName $LogName
foreach ($Event in $Events) {
    $EventXml = [xml]$Event.ToXML()

    $ResultHash = @{
        Time        = $Event.TimeCreated.ToString()
        'Event ID'  = $Event.Id
        'Desc'      = ($Event.Message -split "`n")[0]
        Username    = $EventXml.Event.UserData.EventXML.User
        'Source IP' = $EventXml.Event.UserData.EventXML.Address
        'Details'   = $Event.Message

    $Results += (New-Object PSObject -Property $ResultHash)

$Results | Export-Csv 'Remote Desktop Users.csv'
  • Solid for my usage with a few tweaks! Thanks much! – ssaviers Sep 8 '16 at 16:03

First off, if you didn't log it at the time (or the log has since been overwritten), you're out of luck.

Secondly, you want to look in the Security Event Log, and look for Event ID 528 and 540. Logon type 10 indicates a remote interactive logon (RDP).

  • The Security log does have logon & logoff events, however saving this report with all columns to a CSV file does not show the username for each log. The "User" column is empty. Here is an example CSV screenshot: bit.ly/YgZfhu – Ash Feb 17 '13 at 23:07
  • @Ash Not the right Event IDs there. – HopelessN00b Feb 18 '13 at 12:58

Based on https://gallery.technet.microsoft.com/Log-Parser-to-Identify-8aac36bd

Get-Eventlog -LogName Security | where {$_.EventId -eq "4624"} | select-object @{Name="User"
;Expression={$_.ReplacementStrings[5]}} | sort-object User -unique

You can grab other info from ReplacementStrings. You can also specify a remote computer in the Get-Eventlog command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.