Terminal Service Log File?

[Papilio Herodula]

How can I get a log file of any attempts to log on to
my Windows 2000 Server machine, either via TSC,
FTP, or VPN? I don't see anything in the help files
about it.

I know the Event Viewer will show me if anyone fails
in three attempts to log on with a bad password, but
I cannot see how to follow successful attempts (should
someone obtain or guess a correct user name and
password).

Thanks,

Ph

 

[EEC1 [MSFT]]

You can turn on Auditing through the Local Security Policy:
Start -> Settings -> Control Panel -> Administrative Tools -> Local Security
Policy

Look in: Security Settings\Local Policy\Audit Policy

Enable Auditing (both Success and Failures) for the events you'd like to
have recorded in the Event Log.

For more info:
http://www.microsoft.com/windows200.../windows2000/techinfo/reskit/en-us/gp/515.asp

--

Thanks,
Mike

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Please do not send e-mail directly to this alias.
This alias is for newsgroup purposes only.

 

[Papilio Herodula]

You can turn on Auditing through the Local Security Policy:
Start -> Settings -> Control Panel -> Administrative Tools -> Local Security
Policy

Look in: Security Settings\Local Policy\Audit Policy

Enable Auditing (both Success and Failures) for the events you'd like to
have recorded in the Event Log.

For more info:
http://www.microsoft.com/windows200.../windows2000/techinfo/reskit/en-us/gp/515.asp

Been there, done that, seems to work ok. What about the
IP address of the logon success/failure names? Any way to
see where they came from?

PH