i think you can see this link which will be very helpfull for you...
If you enable auditing of security events, you will see all logon and
logoff events in the Security tab of the EventLog on the TS.
You can filter and export these events once a month to a tab-
delimited textfile for further processing.
Or you could make your own, very simple logon report by adding a line
to your TS-specific login script:
echo %username% %clientname% %date% %time% >> logon.log
http://support.microsoft.c
Main Topics
Browse All Topics





by: sirbountyPosted on 2007-04-22 at 11:46:43ID: 18954821
Use auditing...
com/articl es/Auditin g-user- acc ounts.html for more information... com/window sserver/en /library/ d 8fc798c-1e 77-4043-b5 9c-971b496 1d85a1033. mspx?mfr=t rue also goes into further detail.
Terminal Service access ? With Terminal Services being such an important aspect of Windows 2000/2003/XP, it is essential to audit whether users can logon using this service. With the Terminal Service access, you need to not only check the user property for this access, but also the user rights. For Windows 2000 the user right that must be audited is ?Logon Locally.? For Windows XP and Server 2003, the user right that allows users to logon with Terminal Services is ?Allow logon through Terminal Services.?
ref: http://www.windowsecurity.
http://technet2.microsoft.