Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Auditing Windows 2008 Server access

Posted on 2012-04-07
1
Medium Priority
?
288 Views
Last Modified: 2012-07-03
We have some Windows 2008 servers that multiple departments have RDP access to.

I would like to view who has been logging into these servers by using the Security logs.

Could someone tell me

i. What event id/ event id's I should be looking for in the Sec logs

ii. Is there anyway to find out the IPs that these accounts are logging in from
0
Comment
Question by:bruce_77
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 8

Accepted Solution

by:
teomcam earned 2000 total points
ID: 37819754
If you wanna find out who logged in recently via RDP please use the following command

query session /server:YOURSERVERNAME

And if you find out that someone has logged in and then left the country, you can kick them off too - the above command will tell you each user's session id and you can use this to boot them off the box. In this example, the session id is 1.

rwinsta /server:YOURSERVERNAME 1


If you wanna know who logged in and who logged off please follow the link below.


Event IDs 538 and 540 for tracking Log on and Log off's.


In addition a useful article below
http://www.eventtracker.com/blog/2011-07-20-the-key-difference-between-%E2%80%9Caccount-logon%E2%80%9D-and-%E2%80%9Clogonlogoff%E2%80%9D-events-in-the-windows-security-log/
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question