We have a server that has an open remote desktop port to the internet (no VPN.) Several people are allowed to log on to the machine remotely. The server runs Windows 7 (desktop OS.)

I can find logon times using Event Viewer, but it does not show the IP address of the remote machine. At any rate, manually browsing Event Viewer for all login events would be time consuming, to say the least.)

Is a way to find out which IP addresses are using Remote Dekstop ?


There isn't any built-in functionality to do what you're looking for. Changes in the security architecture of RDP (moving away from the legacy "RDP security layer") have eliminated Event Log messages containing IP addresses for RDP-based logons in recent versions of Windows.

You can deploy some type of script to run on successful logons that would collect the remote IP address, change the RDP listener back to using the old "RDP security layer" (which will cause IP addresses to be logged on both successful and failed logon attempts), or deploy some type of third-party network-layer solution to "sniff" the RDP traffic and report on IP addresses.

| improve this answer | |
  • Thanks for your answer. It's surprising that such basic information is not logged! Our firewall does have good logging, I'll set it up to monitor connections to port 3389. – Andomar Nov 4 '13 at 14:22
  • This is an issue that's familiar to me. I maintain a script (ts_block) for blacklisting IP addresses that generate excessive failed RDP-based logons. Removing logging IP addresses for RDP-based logons has, basically, ended development of the script. – Evan Anderson Nov 4 '13 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.