Solved

Terminal Service Manager console session

Posted on 2009-05-09
9
577 Views
Last Modified: 2012-08-13
I have a Win2003 R2 terminal server.  Users login using RDP.  When I launch the Terminal Server Management console I want to see who has logged in and who has logged out.  It use to save this infomation for me for a couple of days now it does not.  I recently did some MS security updates to the box.  Event log gives me printers and such of people who have logged in but they are anonymous.  I have gone into tools >options in TS Manger and checked the box that says Remember Server Connections, that does not seem to keep the users sessions for me.  Currently when a user log's into the box I see them during their session but when they log out you can not longer see any of the session information ie USER/Processes/Information-including IP address etc.  Could my tsadmin.exe be corrupt and if so how do you replace it.  Also does that carry all my licensing info and configuration info.  Please help.
0
Comment
Question by:NDB1234
  • 4
  • 3
  • 2
9 Comments
 
LVL 5

Expert Comment

by:DTAHARLEV
Comment Utility
when you say "save this information", do you mean it'd show inside terminal server mgmt? also, are you sure it's not that the users are now logging off instead of disconnecting?
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
The terminal server management console *never* kept a history of RDP connections. What you might have seen until now are *disconnected* sessions, but these are *not* "old" sessions of uses having logged out, these are sessions that are still open and using resources, where only the connection to the client has been closed.
In other words: it is perfectly normal if logged out users are disappearing in the TSM console.
You will have to use auditing on whatever server is authenticating the user logons to find out who logged on when.
0
 
LVL 5

Expert Comment

by:DTAHARLEV
Comment Utility
oBdA is right; also, the "remember server connections" checkbox has nothing to do with this i'm afraid
0
 

Author Comment

by:NDB1234
Comment Utility
Thanks for the help.

How do you use auditing?  Why then when a user logged out of my TS did i still see the session information?  I really just need to see who is coming and going on my box. With that said a user with TS rights logs intot he box.  How can i see that they came and went.  All the services on the box start just fine

thanks again
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 5

Accepted Solution

by:
DTAHARLEV earned 125 total points
Comment Utility
configure group policy to audit successful authentication events on this machine, for instance, and go through those logs (you can filter them in the security event log). remember that disconnecting from a session (using the yellow x or by clicking start / disconnect) is totally different than logging off (start / logoff)
0
 

Author Comment

by:NDB1234
Comment Utility
my users click start>logoff
its just before, after they did that i would still see that they came when i opened Terminal server Manager.  I'll take a look at the policys i have set.  Any rec. on a management tool ? thanks
0
 
LVL 82

Assisted Solution

by:oBdA
oBdA earned 125 total points
Comment Utility
How to track users logon/logoff
http://support.microsoft.com/kb/556015

You never saw information from *logged* *out* users; the TS manager only manages and displays live sessions. As I said, what you saw were *disconnected* sessions.
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
It's not unusual for a terminal session not to close properly, even though the user "logged off"; in other words: your TS might now be running better than before ...
0
 
LVL 5

Expert Comment

by:DTAHARLEV
Comment Utility
oh yes, one of the cases in which this happens is when it tries to synchronize offline files and stops; the user is already long gone but the session freezes
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

The System Center Operations Manager 2012, known as SCOM, is a part of the Microsoft system center product that provides the user with infrastructure monitoring and application performance monitoring. SCOM monitors:   Windows or UNIX/LinuxNetwo…
Deploying a Microsoft Access application in a Citrix environment is not difficult but takes a few steps. However, Citrix system people are often of little help, as they typically know next to nothing about Access. The script provided here will take …
The viewer will learn how to use the =DISCRINV command to create a discrete random variable, use this command to model a set of probabilities and outcomes in a Monte Carlo simulation, and learn how to find the standard deviation of a set of probabil…
The viewer will learn how to use a discrete random variable to simulate the return on an investment over a period of years, create a Monte Carlo simulation using the discrete random variable, and create a graph to represent the possible returns over…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now