User access Logging

Hello All,

I'm trying to see if it's possible to see how many times a user has logged into a terminal server (specific dates, times, etc.)

Is this something that is possible?
Who is Participating?
Neil RussellConnect With a Mentor Technical Development LeadCommented:
The event log will ONLY be any use if you have enabled all the correct Auditing policies AND will only be as useful as the size of your event log allows.....

in a log in script just do something like.....

echo User %USERNAME% logged into computer %COMPUTERNAME% on %DATE% at %TIME% >> \\servername\logins$\logons.log
Neil RussellTechnical Development LeadCommented:
Easiest way is with your login script.  Just have it output to a text log file somewhere with the computername, user name, date, time, LOGON or LOGOFF
Timothy McCartneySYS ADMINISTR I INFRASAuthor Commented:
Not positive exactly how one would do that, could you elaborate a little bit more?

Also, if this option had not been in place, is there another way to find this information out? We've had a bit of a security issue and need to try to determine when a user has been logging into a particular sever.
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

you can check in the event log for the user login and logoff.
Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff
Timothy McCartneySYS ADMINISTR I INFRASAuthor Commented:
It looks like the required auditing policies were not in place. The security log only shows a handful of entries, none of which are related to logons/offs.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.