Remote Logon Alerts on SBS 2011

dossbob
dossbob used Ask the Experts™
on
My client wants to get an email alert any time anyone logs on via SBS 2011 Remote Web Access.

I know I can setup an alert from within Event Viewer, but I don't know if there is a unique EventID which definitively indicates a Remote Logon.

1. Does anyone know if there is such an EventID, and if so what it is?
2. Is there any reason to choose the Event Viewer approach over doing it with eventtriggers.exe?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013
Commented:
I know of no way of doing so. There are security success events but not specific to RWW. Type 10 logons within successful logon events indicate remote connections but not necessarily RWA/RWW.
The only logging is done within c:\program files\small business server\logs\webworkplace\w3wp

You can subscribe to AuthAnvil which adds a security token and two step authentication and their service will provide you with logging and I believe notifications if needed:
http://www.scorpionsoft.com/tour/intro

Author

Commented:
Sorry for the delay -- I thought I had already accepted this solution and awarded the points.
Top Expert 2013

Commented:
No problem. Thanks dossbob. I hope that little bit of information was of some help.
Cheers!
--Rob

Author

Commented:
After some more research, it looks like the following would indicate a successful remote logon:

    EventID:  1149
    Source:    Microsoft-Windows-TerminalServices-RemoteConnectionManager

Also, it looks like 1148 means a failed attempt to logon.

I hope that helps someone.
Top Expert 2013

Commented:
Very interesting, thank you for updating. In reviewing apparently that is new with Server 2008 R2. I guess I am behind , apparently I am still thinking pre R2 where it was a very common question.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial