Home / server / Questions / 121399
Accepted
NealWalters
Asked: 2010-03-11 22:49:37 +0800 CST

View Remote Desktop access logs on Win 2003

  • 772

Is there a history log of each use of Remote Desktop. I'd like to view and audit IP addresses. I'm running a dedicated server hosted by a web hosting company. Had some problems recently, and trying to validate if anyone besides me actually logged on (i.e. if user/pass is compromised).

Thanks,

Neal Walters

remote-desktop windows-server-2003 security

2 Answers

  1. Best Answer

    Look in the Security Event Log for a Logon/Logoff Event 528, Logon Type 10

    You can also setup an Audit Policy using the Group Policy editor to log logon success and failures. Go to Run and type gpedit.msc

    Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit logon events. Right click and select properties. Configure as you like.

    • 6

  2. If you don't already have account logon events audited, then turning it on is not going to help you determine who has logged on to the server already. Turning on account logon auditing will help you in the future.

    As far as RDP connections are concerned, there's no specific logging for that.

    • 1