Re: Log terminal server logins?

From: Eric Fitzgerald [MSFT] (ericf@online.microsoft.com)
Date: 03/13/03 

From: "Eric Fitzgerald [MSFT]" <ericf@online.microsoft.com>
Date: Thu, 13 Mar 2003 13:56:17 -0800

Why not use auditing? The logon events (528, 540) include a logon type for
TS logons.

Eric 

-- 
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Vera Noest" <vera.noest@remove-this.hem.utfors.se> wrote in message
news:Xns933BE2CE39540veranoesthemutforsse@207.46.248.16...
> Not in a login skript, for obvious reasons. I wouldn't know of any other
> way than to extract that information from the EventLog (make sure you
> enable auditing for all security events). You can either export the
> EventLog by hand on a regular basis, or use a utility from the Resource
Kit
> or one of the numerous freeware utilities and run that overnight in a
batch
> job.
> -- 
> Vera Noest
> MCSE, CCEA
> http://hem.fyristorg.com/vera/IT
>  --- please answer in newsgroup ---
>
> "FKern" <FKern@askme.com> wrote in news:Ligba.147533$XB3.71145
> @news1.west.cox.net:
>
> >
> > Any way to do something similar for failed logins?
> >
> > "Vera Noest" <vera.noest@remove-this.hem.utfors.se> wrote in message
> > news:Xns93397A9DB794Dveranoesthemutforsse@207.46.248.16...
> >> Put something like this into your users login skript:
> >>
> >> echo %username% %clientname% %date% %time% >> logon.log
> >>

Relevant Pages

  • Re: GPO Policy Auditing Solution
    ... within the Domain Controller's OU and enable account logon auditing in the ... enable auditing for logon events. ...
    (microsoft.public.windows.server.networking)
  • Re: Auditing Logon Events
    ... > I have just been trying to set up auditing on my 2k DC to log every time a ... > user logs onto the system. ... Account logon events will log every request to the DC for authentication; ...
    (microsoft.public.windows.server.active_directory)
  • RE: find on which computer is connected a user
    ... You may try to enable the policy "Audit Logon Events" and then audit the ... Write events to the event log of a specified server concerning the status ...
    (microsoft.public.windows.server.general)
  • Re: Bypass Traverse Checking
    ... > The odd thing is in my Event log, I see an entry granting it to a specific ... > Special privileges assigned to new logon: ... > Privileges: SeChangeNotifyPrivilege ... If you are auditing logon events for Everyone, ...
    (microsoft.public.windowsxp.security_admin)
  • RE: how can I see when the last time it was when a computer loged on
    ... You can try to enable the policy "Audit logon events" and then we can audit ... Events->Select Success and Failure. ...
    (microsoft.public.windows.server.sbs)