We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)?
Audit Logon Events
So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server.
To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a descriptive name. Audit_Remote_logons seems good enough for me. Then go "Computer Configuration --> Policies --> Windows Settings --> Security --> Local Policy --> Audit Policy --> Then open Audit Logon Events and then enable "Success" and "Failure"
Now link the GPO the the OUs you want this enabled for.
Optionally, run "GPUdate /force" on your production servers. After this policy has been applied you can go into your security events logs and view the successful logon/logoff events.
Audit Logon Events So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server.
To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a descriptive name. Audit_Remote_logons seems good enough for me. Then go "Computer Configuration --> Policies --> Windows Settings --> Security --> Local Policy --> Audit Policy --> Then open Audit Logon Events and then enable "Success" and "Failure"
Now link the GPO the the OUs you want this enabled for.
Optionally, run "GPUdate /force" on your production servers. After this policy has been applied you can go into your security events logs and view the successful logon/logoff events.