Track RWW users?

I am running SBS08 and need a way to track RWW log on's and log off's.  Anyone out there have a solution to do this?
wdabbsAsked:
Who is Participating?
 
Rob WilliamsConnect With a Mentor Commented:
The RWW logging is done in the following log:
C:\Program Files\Windows Small Business Server\Logs\WebWorkplace\w3wp.log
It will take a while to parse the necessary information.

I have used logon and log off scripts to document terminal server users. The same can be used for RWW sessions but it would log every connection by a user to any PC whether local or remote so it will get lengthy. It will show the IP from which they connected so you determinermin if it was local or RWW. In the case of RWW rather than terminal services, I think it will show the SBS IP rather than the actual remote IP.

Add the lines below to each users logon and log off script to create a log file. It would give you UserName, ComputerName, date and time, in a simple single line, followed by the IP from which they connected, if needed. If you wish to know logoff times as well, you can add the same lines to a log off script in group policy (if you don't already have one: User Configuration | Windows settings | Scripts | Logoff). You likely won’t need the last line (IP address) in the log off script.

As written below it will create the log/text file in \\Server\Logs\LogOns.Log and the entries will look like:
Log File

Log On:  jdoe SERVER1  Tue 1/1/2007   9:01
  TCP    10.0.1.100:3389        66.66.123.123:1234        ESTABLISHED

Log Off: jdoe SERVER1  Tue 1/1/2007   9:31

Log On:  jsmith SERVER2  Tue 1/1/2007   11:00
  TCP    10.0.1.200:3389        66.66.123.124:1234        ESTABLISHED

Log Off: jsmith SERVER1  Tue 1/1/2007   11:30
---------------------------------------------------------------------------

:Logging
If Exist "\\Server\Logs\LogOns.Log" GoTo START
Echo Log File > "\\Server\Logs\LogOns.Log"
:START
Echo. >> "\\Server\Logs\LogOns.Log"
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,16%  %Time:~0,5% >> "\\Server\Logs\LogOns.Log"
netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\Server\Logs\LogOns.Log"

---------------------------------------------------------------------------
Note the users will need to have read/write and execute permissions for the \\Server\Logs\LogOns.Log  file.
0
 
Lee W, MVPConnect With a Mentor Technology and Business Process AdvisorCommented:
Tracking log ons should be easy enough - you can use web logs or Event Logs.  Tracking log offs is another story.  The RWW session will time-out but things like Remote Desktop Sessions can remain open.
0
 
wdabbsAuthor Commented:
Look for a bit more granular information, such as user who is logging in and when
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
Rob WilliamsCommented:
I don't understand why you are deleting the question when you received a viable answer. Though it may not be exactly what you were looking for, some sort of reply might have allowed us to assist further.
It is frustrating for the "experts", who volunteer their time, to take the time to try to carefully answer a question and then have the author delete it out of lack of interest.
--Rob
0
 
Rob WilliamsCommented:
Thank you wdabbs. Please let us know if we can help further with the reporting.
Cheers!
--Rob
0
 
wdabbsAuthor Commented:
Sorry, I am not the one from this company who posted this question and it looks to have been abandoned, I could not post a new question with this one still out here so I tried deleting it. I am sorry if that bummed you out. Since I can't find out who authored this question to begin with, I'll go ahead and accept your solution and we can move forward. All of us here appreciate the work you all do and you have put us on the right track many times
0
 
Rob WilliamsCommented:
Thanks for explaining wdabbs, I appreciate your circumstances.
We all understand that happens, juts post a note to that effect in future and then delete or close. Even a "that won't work" is fine. Sorry to be a whiner :-)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.