Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 410
  • Last Modified:

Terminal Services - disconnects

I have an environment where there are remote users accessing a central Terminal Server through the Internet - relatively high speed ADSL at both ends.  The remote users complain of disconnects - they are suddenly booted off the system.  Unfortunately they are too busy to do anything at the time other than just try logging in/rebooting that they don't report the exact time of the event. Is there an event log item that I could correlate to such disconnects/reconnects? If not, are there tools that would give me times of such disconnects/reconnects?
0
lineonecorp
Asked:
lineonecorp
  • 2
1 Solution
 
sherenianCommented:
You should be able to look in the Event Viewer and see when a specific user logged on or authenticated to the server and then you should see a second time where he authenticated.  The time stamps on the two authentications will tell you when they logged in and the duration between the two will tell you how long it took for them to get booted off.

The Event Viewer is under Administrative Tools
0
 
lineonecorpAuthor Commented:
I believe you can add 'events' to be monitored to Event Viewer. Is there a 'disconnection' event that I could monitor which would be the actual 'kicked off' event with some kind of detail attached to it? I don't want to be looking at regular log offs - I just want disconnects.


0
 
sherenianCommented:
I don't think you will be able to track the disconnect time. Perhaps if the user was intentionally "Logging Off" then we could track it but random disconnects, not so much.  The only way I know of to get an approx. time of the disconnect is to see what time they logged back in.   By default, your Event Log under "Security" should show user logins, failed password attemps, etc.  You can right-click on the "Security" title and goto "Properties".  You can run a filter there so you can see all listings associated with a specific member, or specific type of event (security related) so you can narrow things down and see when they logged on, when they logged back on and figure out the approx disconnect time.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now