Remote Desktop Logs

Archived from groups: microsoft.public.windowsxp.work_remotely (More info?)

I wanted to know if there are any logs maintained by Windows XP when someone
connects through a Remote Desktop??
Could anyone let me know how to look thorugh the Event Logs to find any
remote desktop attempt (successful/unsuccessful)

Best Wishes,
-Aayush
2 answers Last reply
More about remote desktop logs
  1. Archived from groups: microsoft.public.windowsxp.work_remotely (More info?)

    Look in the Event Log (Security) for a Logon/Logoff Event 528. It should have a Logon Type 10...

    You can setup an Audit Policy using the Group Policy editor to log logon success and failures. Go
    to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer Policy ->
    Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
    Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
    desired. Note, some folks have XP boxes setup to login without a password. Logging in
    without a password counts as a "failure". This results in the security log filling up very fast if
    you log failures and have a user without a password. I fell into that trap while testing a new XP
    Pro box once. The result is you can not login normally. Also note, not having a password is
    a potential and probable security risk.

    The event log can be viewed by going to "Start -> Control Panel -> Performance and Maintenance ->
    Administrative Tools" and click on "Event Viewer".

    Also see this page for other Audit Logon information...

    http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/518.asp

    Lastly, you might look at the Port Reporter tool for additional logging...Specifically the PR-Ports
    log file...

    http://support.microsoft.com/default.aspx?scid=kb;[LN];837243

    --
    Al Jarvi (MS-MVP Windows Networking)

    Please post *ALL* questions and replies to the news group for the mutual benefit of all of us...
    The MS-MVP Program - http://mvp.support.microsoft.com
    This posting is provided "AS IS" with no warranties, and confers no rights...

    "Aayush Puri" <AayushPuri@discussions.microsoft.com> wrote in message
    news:C39917F0-BF1A-4C16-B0E9-572BE7BB2F5F@microsoft.com...
    >I wanted to know if there are any logs maintained by Windows XP when someone
    > connects through a Remote Desktop??
    > Could anyone let me know how to look thorugh the Event Logs to find any
    > remote desktop attempt (successful/unsuccessful)
    >
    > Best Wishes,
    > -Aayush
  2. Archived from groups: microsoft.public.windowsxp.work_remotely (More info?)

    Thankx a lot....your suggesstion was great. I think I got what I was looking
    for.

    -Aayush

    "Sooner Al" wrote:

    > Look in the Event Log (Security) for a Logon/Logoff Event 528. It should have a Logon Type 10...
    >
    > You can setup an Audit Policy using the Group Policy editor to log logon success and failures. Go
    > to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer Policy ->
    > Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
    > Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
    > desired. Note, some folks have XP boxes setup to login without a password. Logging in
    > without a password counts as a "failure". This results in the security log filling up very fast if
    > you log failures and have a user without a password. I fell into that trap while testing a new XP
    > Pro box once. The result is you can not login normally. Also note, not having a password is
    > a potential and probable security risk.
    >
    > The event log can be viewed by going to "Start -> Control Panel -> Performance and Maintenance ->
    > Administrative Tools" and click on "Event Viewer".
    >
    > Also see this page for other Audit Logon information...
    >
    > http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/518.asp
    >
    > Lastly, you might look at the Port Reporter tool for additional logging...Specifically the PR-Ports
    > log file...
    >
    > http://support.microsoft.com/default.aspx?scid=kb;[LN];837243
    >
    > --
    > Al Jarvi (MS-MVP Windows Networking)
    >
    > Please post *ALL* questions and replies to the news group for the mutual benefit of all of us...
    > The MS-MVP Program - http://mvp.support.microsoft.com
    > This posting is provided "AS IS" with no warranties, and confers no rights...
    >
    > "Aayush Puri" <AayushPuri@discussions.microsoft.com> wrote in message
    > news:C39917F0-BF1A-4C16-B0E9-572BE7BB2F5F@microsoft.com...
    > >I wanted to know if there are any logs maintained by Windows XP when someone
    > > connects through a Remote Desktop??
    > > Could anyone let me know how to look thorugh the Event Logs to find any
    > > remote desktop attempt (successful/unsuccessful)
    > >
    > > Best Wishes,
    > > -Aayush
    >
    >
Ask a new question

Read More

Remote Desktop Microsoft Windows XP