Tracking When Profiles Logged On

Is there somewhere in Terminal Services that tracks who
logged in when? I checked all the Event Logs, and can't
seem to find anything that will list that. Now, I'm not
the sharpest pencil in the box when it comes to hunting
little stuff like this down, so if anyone knows if it's
something built into Terminal Services - or if I have to
get a 3rd party app - let me know.

Thanks!

You have to enabled auditing of security events in your domain. The
Security tab of the EventLog will then show you all logon and logoff
events.

--
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
--- please respond in newsgroup ---

"M Faulkner" <mary@weplanreunions.com> wrote in news:044b01c38c45
$6761ca80$a401280a@phx.gbl:

> Is there somewhere in Terminal Services that tracks who
> logged in when? I checked all the Event Logs, and can't
> seem to find anything that will list that. Now, I'm not
> the sharpest pencil in the box when it comes to hunting
> little stuff like this down, so if anyone knows if it's
> something built into Terminal Services - or if I have to
> get a 3rd party app - let me know.
>
> Thanks!

Just turn on auditing. This should tell you who and when
they logged on. You can do this through your local
security policies.

-M

>-----Original Message-----
>Is there somewhere in Terminal Services that tracks who
>logged in when? I checked all the Event Logs, and can't
>seem to find anything that will list that. Now, I'm not
>the sharpest pencil in the box when it comes to hunting
>little stuff like this down, so if anyone knows if it's
>something built into Terminal Services - or if I have to
>get a 3rd party app - let me know.
>
>Thanks!
>.
>

I enabled the auditing in the Local Settings following the
instructions in the Knowledge Base, but it didn't log my
subsequent log on to the server. Do I need to change
something in the domain?


>-----Original Message-----
>You have to enabled auditing of security events in your
domain. The
>Security tab of the EventLog will then show you all logon
and logoff
>events.
>
> --
>Vera Noest
>MCSE, CCEA, Microsoft MVP - Terminal Server
>http://hem.fyristorg.com/vera/IT
> --- please respond in newsgroup ---
>
>"M Faulkner" <mary@weplanreunions.com> wrote in
news:044b01c38c45
>$6761ca80$a401280a@phx.gbl:
>
>> Is there somewhere in Terminal Services that tracks who
>> logged in when? I checked all the Event Logs, and
can't
>> seem to find anything that will list that. Now, I'm
not
>> the sharpest pencil in the box when it comes to hunting
>> little stuff like this down, so if anyone knows if it's
>> something built into Terminal Services - or if I have
to
>> get a 3rd party app - let me know.
>>
>> Thanks!
>.
>

That depends on you domain structure and OU setup. Since auditing
of security events is a good thing to have anyway, I would enable
it in the Default Domain Security Policy and make sure that this
is a setting that can't be overridden be GPOs on a OU lower in the
hierarchy.
If you want to enable it only on your TS and there is a
conflicting policy (disabling auditing) for the domain, you can
try the setting "block inheritance" of overriding policies, or use
loopback provessing of the policy. But I would enable it in the
domain as a whole.

260370 - How to Apply Group Policy Objects to Terminal Services
Servers
http://support.microsoft.com/?kbid=260370

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287

--
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
--- please respond in newsgroup ---

"M Faulkner" <mary@weplanreunions.com> wrote in news:077001c38d1d
$cbc1ce70$a101280a@phx.gbl:

> I enabled the auditing in the Local Settings following the
> instructions in the Knowledge Base, but it didn't log my
> subsequent log on to the server. Do I need to change
> something in the domain?
>
>
>>-----Original Message-----
>>You have to enabled auditing of security events in your
> domain. The
>>Security tab of the EventLog will then show you all logon
> and logoff
>>events.
>>
>>
>>"M Faulkner" <mary@weplanreunions.com> wrote in
> news:044b01c38c45
>>$6761ca80$a401280a@phx.gbl:
>>
>>> Is there somewhere in Terminal Services that tracks who
>>> logged in when? I checked all the Event Logs, and
> can't
>>> seem to find anything that will list that. Now, I'm
> not
>>> the sharpest pencil in the box when it comes to hunting
>>> little stuff like this down, so if anyone knows if it's
>>> something built into Terminal Services - or if I have
> to
>>> get a 3rd party app - let me know.
>>>
>>> Thanks!