windows server last access timestamp (RDP)

Is there a relatively easy way to determine the last time an officer last logged on (e.g RDP) to a windows server? I need to verify a list of officers with admin access to a server and need some stats on last access to help flag potential inappropriate assignment of admin rights.
LVL 4
pma111Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Huig GuijtSystem AdministratorCommented:
You would have to enable auditing of logon events on every RDS Host.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

Then monitor our forward your event log for event 528.
0
McKnifeCommented:
If this is about domain accounts: domain controllers would log logon events by default (starting with server 2008). So you could use their security event logs, if they date back that far. Open it and search for the account name. Or parse the log using powershell (sorry, no script example at hand).
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
austin minorCommented:
If you have auditing enabled then you will have events in the event logs and also you can configure an alert, looking for those particular events.

Check if this point you:

How to keep track of privileged user accounts in Active Directory:
https://community.spiceworks.com/how_to/128307-how-to-keep-track-of-privileged-user-accounts-in-active-directory
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.