Remote Desktop auditing

[Guest]

Let's say I have multiple users on an XP pro machine that remotely access
this computer via Remote Desktop. Is there a way to audit their RD usage:
when they log in, how long they stay connected, and what files that they use
while logged on?

Just how extensive is user activity auditing in XP pro anyway? I know that
the Server OS has extensive auditing capabilities, but how about XP Pro? Any
links to sites that have tutorials on security and file access auditing is
greatly appreciated.

 

[Jon Phipps]

If you are doing hosting or having many people connect through remote
desktop/TSC then it may be advised to get a server package. I have heard
that XP will only allow 10 concurrent connections. If I am wrong I am sure
that others on this group will correct me.

Jon

 

[ewiley]

XP only allows one remote desktop connection (if you're talking about
using the built-in Remote Desktop, rather than a 3rd-party tool such as
VNC or PCAnywhere), and supports 5 or 10 remote sessions for file/print
sharing.

XP's auditing is about as strong as Windows 2000/2003's, you can setup
auditing of logon events by going to Control Panel, Administrative
Tools, Local Security Policy, expand Local Policies and select Audit
Policy.

 

[Steven L Umbach]

XP Pro has the same auditing capabilities as Windows 2003 Server other than
the domain controller functions. You would want to enable auditing of
account logon events and maybe logon events in Local Security Policy. To see
file access is MUCH more involved and requires that you first enable
auditing of object access and then audit the folders you want to monitor for
the user/group and permissions that you want to track. This is not a user
friendly process as thousands of object access events will be recorded in
the security log but the info should be there and using Event Comb can help
you find what you are looking for. The links below may be helpful. ---
Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260 --- same
for XP Pro
http://support.microsoft.com/default.aspx?scid=kb;en-us;300549 --- ditto
http://www.microsoft.com/technet/se...andmonitoring/securitymonitoring/default.mspx

 

[Sooner Al [MVP]]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

In addition to the comments of the others this page has some information
about logging RDP connections for a home user...

http://tinyurl.com/5335u

- --

Al Jarvi (MS-MVP Windows Networking)

Please post *ALL* questions and replies to the news group for the mutual
benefit of all of us...
The MS-MVP Program - http://mvp.support.microsoft.com
This posting is provided "AS IS" with no warranties, and confers no
rights...

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.3 (Build 2932) - not licensed for commercial use:
www.pgp.com

iQEVAwUBQ6iJsRU2gKNumcJAAQjWZgf+M0aSNHL7CDpt1twhuLbV7RpOo4kyKcyC
O+RusB/FF8fcDEbVMSppGaiVnBXNWMjZbVHrm22Pzotio5sS1jLhhJgFbNdiP+P5
9Uvbt4ew/CreGddb2OTsZOqcBFDyTf1tp0dGqU/UQbSoTKDWXnC0vwQY8Fgno54u
kmkIE6qXai0mZhYXjSK0k1tnOQ+cXdxA8sKHCdmHvg5xvaoj73QHDA4gj2oNB52x
DG35P8acXV8pv3aJvEk56tKgnctDV2hElkHIb4Rxd2kZwmnfjKyRwZK2/zY6eClZ
0RFOir96b+MOjBnW1LEkblYUgLnHV4KSaYJW3ZTUgU5nvgZGxW6MaA==
=6vVw
-----END PGP SIGNATURE-----