How can I tell if anyone ever logged into machine remotely?

[Bruce D. Meyer]

I need to discover if anyone ever logged in remotely to a specific machine.
I have looked at the event log filtering for:
I searched the event viewer under Application, Security, System, for RDC,
Remote Assistance, Remote Desktop, and zero hits under any facility were
returned. (Info, Warning, Error, Success audit, Failure Audit)

No invitations were listed under 'invitation status' for Remote Assistance,
but it is set for a 30 day expiry. Are their files or registry remnants I can
search for? (I searched for ".rdp" but I would expect those to be for
outbound not inbound.

Thank you,
-- Bruce D. Meyer

 

[John Wunderlich]

=?Utf-8?B?QnJ1Y2UgRC4gTWV5ZXI=?=

I need to discover if anyone ever logged in remotely to a specific
machine. I have looked at the event log filtering for:
I searched the event viewer under Application, Security, System,
for RDC, Remote Assistance, Remote Desktop, and zero hits under
any facility were returned. (Info, Warning, Error, Success audit,
Failure Audit)

No invitations were listed under 'invitation status' for Remote
Assistance, but it is set for a 30 day expiry. Are their files or
registry remnants I can search for? (I searched for ".rdp" but I
would expect those to be for outbound not inbound.

Thank you,
-- Bruce D. Meyer

If this was an XP Pro machine, then a logon event will be present in
the Security Log *if* account login events have been
configured/enabled to appear there (XP Home can't do this).

To enable logging of login events:
Start->Run->"gpedit.msc"
then,
Local Computer Policy->Computer Configuration ->
Windows Settings -> Security Settings -> Local Policies ->
Audit Policy.
Then double-click on "Audit Account Logon Events" and set
accordingly.

It seems that you didn't have logon events enabled, so it will be
difficult to ascertain when/whether a login occurred.

HTH,
John