How to record logon/off TS client.

  • Thread starter Thread starter ThomasAJ
  • Start date Start date
T

ThomasAJ

Guest
I want to record my remote users' logon/off somewhere. Is that possible?

--
Regards
Tom
 
Re: How to record logon/off TS client.

Sure. Assuming that auditing of logon and logoff events is enabled,
it's already there. Check the security tab of the EventLog on the
server.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>
wrote on 12 sep 2007 in
microsoft.public.windows.terminal_services:

> I want to record my remote users' logon/off somewhere. Is that
> possible?
 
Re: How to record logon/off TS client.

Sorry but I do not know what you are referring to.
I looked at the 'Event Log' service but could not see any Security tab.
Looked at Event Viewer but no TS logging.

Are you able to hand hold me a little longer please.

--
Regards
Tom


"Vera Noest [MVP]" wrote:

> Sure. Assuming that auditing of logon and logoff events is enabled,
> it's already there. Check the security tab of the EventLog on the
> server.
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>
> wrote on 12 sep 2007 in
> microsoft.public.windows.terminal_services:
>
> > I want to record my remote users' logon/off somewhere. Is that
> > possible?
>
 
Re: How to record logon/off TS client.

To be able to see all logon and logoff events in the Security tab
of EventViewer (which I referred to - a little sloppy - as the
EventLog), you have to enable auditing of these events.
That can be configured on a number of levels: for the entire
domain, for the OU which the TS is located in, or only on the TS.
Whereever you decide to do this, it is a setting in the group
policy object (GPO).

You can find it under Computer Configuration - Windows settings -
Security settings - Local policies - Audit policy
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>
wrote on 13 sep 2007:

> Sorry but I do not know what you are referring to.
> I looked at the 'Event Log' service but could not see any
> Security tab. Looked at Event Viewer but no TS logging.
>
> Are you able to hand hold me a little longer please.
 
Re: How to record logon/off TS client.

Thanks. As far as I can see it's being logged (Event Viewer/Security) but I
did not notice it before as the log is completelly full of event #s 538 and
540 caused by 'ANONYMOUS LOGON' at the rate of 8 events per minute 24/7.

1. What is that about?
2. Can/should I stop it?
3. If not can I hide it?

many thanks
--
Regards
Tom


"Vera Noest [MVP]" wrote:

> To be able to see all logon and logoff events in the Security tab
> of EventViewer (which I referred to - a little sloppy - as the
> EventLog), you have to enable auditing of these events.
> That can be configured on a number of levels: for the entire
> domain, for the OU which the TS is located in, or only on the TS.
> Whereever you decide to do this, it is a setting in the group
> policy object (GPO).
>
> You can find it under Computer Configuration - Windows settings -
> Security settings - Local policies - Audit policy
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> *----------- Please reply in newsgroup -------------*
>
> =?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>
> wrote on 13 sep 2007:
>
> > Sorry but I do not know what you are referring to.
> > I looked at the 'Event Log' service but could not see any
> > Security tab. Looked at Event Viewer but no TS logging.
> >
> > Are you able to hand hold me a little longer please.
>
 
Re: How to record logon/off TS client.

Difficult to say without knowing much more about your environment.
You can check the Logon Type of these events, where Logon Type 2 =
interactive and Logon type 3 = network connection.
I suspect that most of these events are of Logon Type 3.

You can't stop them without disabling auditing of all logon and
logoff events. You can try to use a filter in EventViewer to see only
those events you are interested in

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>
wrote on 14 sep 2007 in
microsoft.public.windows.terminal_services:

> Thanks. As far as I can see it's being logged (Event
> Viewer/Security) but I did not notice it before as the log is
> completelly full of event #s 538 and 540 caused by 'ANONYMOUS
> LOGON' at the rate of 8 events per minute 24/7.
>
> 1. What is that about?
> 2. Can/should I stop it?
> 3. If not can I hide it?
>
> many thanks
 
Back
Top