<div>
Sorry for the delay -- I thought I had already accepted this solution and awarded the points.
</div>


<div>
No problem. Thanks dossbob. I hope that little bit of information was of some help.<br />
Cheers!<br />
--Rob
</div>


<div>
After some more research, it looks like the following would indicate a successful remote logon:<br />
<br />
&nbsp; &nbsp; EventID: &nbsp;1149<br />
&nbsp; &nbsp; Source: &nbsp; &nbsp;Microsoft-Windows-Terminal<wbr />Services-R<wbr />emoteConne<wbr />ctionManag<wbr />er<br />
<br />
Also, it looks like 1148 means a failed attempt to logon.<br />
<br />
I hope that helps someone.
</div>


<div>
Very interesting, thank you for updating. In reviewing apparently that is new with Server 2008 R2. I guess I am behind , apparently I am still thinking pre R2 where it was a very common question.
</div>


<div>
<div class="content wysiwyg-content">
My client wants to get an email alert any time anyone logs on via SBS 2011 Remote Web Access.<br />
<br />
I know I can setup an alert from within Event Viewer, but I don't know if there is a unique EventID which definitively indicates a Remote Logon.<br />
<br />
1. Does anyone know if there is such an EventID, and if so what it is?<br />
2. Is there any reason to choose the Event Viewer approach over doing it with eventtriggers.exe?
</div>
</div>


My client wants to get an email alert any time anyone logs on via SBS 2011 Remote Web Access.

I know I can setup an alert from within Event Viewer, but I don't know if there is a unique EventID which definitively indicates a Remote Logon.

1. Does anyone know if there is such an EventID, and if so what it is?
2. Is there any reason to choose the Event Viewer approach over doing it with eventtriggers.exe?

Sorry for the delay -- I thought I had already accepted this solution and awarded the points.

No problem. Thanks dossbob. I hope that little bit of information was of some help.
Cheers!
--Rob

After some more research, it looks like the following would indicate a successful remote logon:

    EventID:  1149
    Source:    Microsoft-Windows-TerminalServices-RemoteConnectionManager

Also, it looks like 1148 means a failed attempt to logon.

I hope that helps someone.

Very interesting, thank you for updating. In reviewing apparently that is new with Server 2008 R2. I guess I am behind , apparently I am still thinking pre R2 where it was a very common question.

Remote Logon Alerts on SBS 2011

My client wants to get an email alert any time anyone logs on via SBS 2011 Remote Web Access.

I know I can setup an alert from within Event Viewer, but I don&amp;#39;t know if there is a unique EventID which definitively indicates a Remote Logon.

1. Does anyone know if there is such an EventID, and if so what it is?
2. Is there any reason to choose the Event Viewer approach over doing it with eventtriggers.exe?

Microsoft server applications are those applications developed specifically, but not necessarily exclusively, on the Windows Server platform. In addition to well-known products like SQL Server, Exchange, Internet Information Services (IIS), Microsoft Dynamics, Forefront, Lync and Sharepoint, they include applications like Skype, BizTalk, Hyper-V, Groove and Commerce Server. Server applications are managed with the Microsoft System Center.

Microsoft Server Apps

The Microsoft Legacy Operating System topic includes legacy versions of Microsoft operating systems prior to Windows 2000: All versions of MS-DOS and other versions developed for specific manufacturers and Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions, and Windows Mobile.

Microsoft Legacy OS

Small Business Server (SBS) is a line of server operating systems targeted at small businesses by bundling the operating system with a number of other Microsoft products that would normally need to be purchased or licensed separately. The most notable inclusions are Exchange, SQL Server, SharePoint and ISA/TMG (Microsoft's firewall and proxy server).