Where can I find out who logs in/out of Windows Terminal Services 2003?

saunaG used Ask the Experts™
I have terminal services running on my windows 2003 server box.  I want to find out who logged in and out of a terminal services session at any time.  Is there a log file where this is stored?  I can go into the event viewer security section and find out but there are so many entries there i dont want to sift through.
I would think that there is a simple log kept somewhere of terminal services logons.

Anyone know?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
As far as I am aware there is no such file. Have you tried filtering the security event log for only the event type you wish to see?

sorry its wrapped but the link above shows a list of event types you may wish to filter for in the log. This document also goes some way towards explaining the significance of each event (success, failure etc). For instance event 528 with a logon type of 10 indicates a successful TS login. There are 3rd party tools which will do this for you, with cost depending on the number of servers you want to monitor.

Obviously for these events to be logged you need to ensure the correct logging is enabled (usually through the group policy or through local security policy)

You can see who is logged on by running the Terminal Services Manager.


Thanks! Good enough for me.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial