User access Logging

Hello All,

I'm trying to see if it's possible to see how many times a user has logged into a terminal server (specific dates, times, etc.)

Is this something that is possible?
LVL 10
Timothy McCartneySYS ADMINISTR I INFRASAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Neil RussellTechnical Development LeadCommented:
Easiest way is with your login script.  Just have it output to a text log file somewhere with the computername, user name, date, time, LOGON or LOGOFF
0
Timothy McCartneySYS ADMINISTR I INFRASAuthor Commented:
Not positive exactly how one would do that, could you elaborate a little bit more?

Also, if this option had not been in place, is there another way to find this information out? We've had a bit of a security issue and need to try to determine when a user has been logging into a particular sever.
0
AnuroopsunddCommented:
you can check in the event log for the user login and logoff.
Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff
0
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

AnuroopsunddCommented:
0
Neil RussellTechnical Development LeadCommented:
The event log will ONLY be any use if you have enabled all the correct Auditing policies AND will only be as useful as the size of your event log allows.....

in a log in script just do something like.....

echo User %USERNAME% logged into computer %COMPUTERNAME% on %DATE% at %TIME% >> \\servername\logins$\logons.log
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Timothy McCartneySYS ADMINISTR I INFRASAuthor Commented:
It looks like the required auditing policies were not in place. The security log only shows a handful of entries, none of which are related to logons/offs.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.