Solved

Auditing Windows 2008 Server access

Posted on 2012-04-07
1
282 Views
Last Modified: 2012-07-03
We have some Windows 2008 servers that multiple departments have RDP access to.

I would like to view who has been logging into these servers by using the Security logs.

Could someone tell me

i. What event id/ event id's I should be looking for in the Sec logs

ii. Is there anyway to find out the IPs that these accounts are logging in from
0
Comment
Question by:bruce_77
1 Comment
 
LVL 8

Accepted Solution

by:
teomcam earned 500 total points
ID: 37819754
If you wanna find out who logged in recently via RDP please use the following command

query session /server:YOURSERVERNAME

And if you find out that someone has logged in and then left the country, you can kick them off too - the above command will tell you each user's session id and you can use this to boot them off the box. In this example, the session id is 1.

rwinsta /server:YOURSERVERNAME 1


If you wanna know who logged in and who logged off please follow the link below.


Event IDs 538 and 540 for tracking Log on and Log off's.


In addition a useful article below
http://www.eventtracker.com/blog/2011-07-20-the-key-difference-between-%E2%80%9Caccount-logon%E2%80%9D-and-%E2%80%9Clogonlogoff%E2%80%9D-events-in-the-windows-security-log/
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question