Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How does one track VPN and Remote Desktop Users

Posted on 2010-08-17
3
Medium Priority
?
975 Views
Last Modified: 2012-05-10
We have a Windows 2003 Server on a server with a number of different virtual machines.  I've had some recent concerns about when some of our users have been VPNing into the network and which machines have been Remote Desktopped into.  Can someone explain exactly which logs would contain the user name, date and time of VPN acccess and Remote Desktop use? Thanks.
0
Comment
Question by:tklingman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 4

Accepted Solution

by:
ericnils earned 168 total points
ID: 33456501
The security log in Event Viewer records all authentication events with a user name and time stamp.  If you are using AD authentication you already have this logging centralized on the domain controller(s)
0
 
LVL 1

Assisted Solution

by:ShattyP
ShattyP earned 168 total points
ID: 33456533
Are you using Windows  IAS to handle authentication?  If so, open IAS and select 'Remote Access Logging.'  Tell it where you want it to store the logs and the name format for the log.  Such as E:\Logs.  Tell it to create a new log file everyday and select the boxes that tell it to log Accounting and Authentication requests.   These logs will give you the time, the username and the IP address of users connecting to your network.  
0
 
LVL 5

Assisted Solution

by:ploftin
ploftin earned 164 total points
ID: 33456548
What type of VPN are you referring to?  If it's a Microsoft routing and remote access setup, look in C:\Windows\Tracing for the RRAS logs.

As for Remote Desktop logging, look in the Event Log (Security) for a Logon/Logoff Event 528. It should have a Logon Type 10. The event log can be viewed by going to "Start -> Run -> eventvwr.exe".

You need to setup an Audit Policy using the Group Policy editor to log logon success and failures. Go
to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer Policy ->
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
desired.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
An article on effective troubleshooting
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…

704 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question