Home / server / Questions / 550501
Accepted
Andomar
Asked: 2013-11-04 23:17:09 +0800 CST

Which IP addresses are using remote dekstop?

  • 772

We have a server that has an open remote desktop port to the internet (no VPN.) Several people are allowed to log on to the machine remotely. The server runs Windows 7 (desktop OS.)

I can find logon times using Event Viewer, but it does not show the IP address of the remote machine. At any rate, manually browsing Event Viewer for all login events would be time consuming, to say the least.)

Is a way to find out which IP addresses are using Remote Dekstop ?

security

1 Answers

  1. Best Answer

    There isn't any built-in functionality to do what you're looking for. Changes in the security architecture of RDP (moving away from the legacy "RDP security layer") have eliminated Event Log messages containing IP addresses for RDP-based logons in recent versions of Windows.

    You can deploy some type of script to run on successful logons that would collect the remote IP address, change the RDP listener back to using the old "RDP security layer" (which will cause IP addresses to be logged on both successful and failed logon attempts), or deploy some type of third-party network-layer solution to "sniff" the RDP traffic and report on IP addresses.

    • 3