Remote Desktop- Any logging?

External Since: Aug 16, 2004 Posts: 114

Are there any logs created on the host machine showing when someone made a
RDP connection. I would like to know what user and what IP address was used
to establish a connection.

External Since: Jul 05, 2004 Posts: 181

There should be an entry in the security log available via Event Viewer if
auditing of logon events is enabled which it may be by default. Look for
type 10 logon events. However you may need see the IP address but instead
the name of the computer. Firewall logs [hardware or host] may help track
down the IP of the computer if you match the logs to the time of the type 10
logon event.

Steve

http://www.windowsecurity.com/articles/Logon-Types.html --- logon events
explained

Logon Type 10 - RemoteInteractive
When you access a computer through Terminal Services, Remote Desktop or
Remote Assistance windows logs the logon attempt with logon type 10 which
makes it easy to distinguish true console logons from a remote desktop
session. Note however that prior to XP, Windows 2000 doesn't use logon type
10 and terminal services logons are reported as logon type 2.

"Sam" wrote in message

> Are there any logs created on the host machine showing when someone made a
> RDP connection. I would like to know what user and what IP address was
> used
> to establish a connection.