Terminal sever remote desktop login logging?

[Fred Blum]

I've enabled the RDP tru our firewall. I want to log all remote desktop
connections made to this server. It is in adminstrative mode.

The security policy is enabled. But this fills up and is to extensive and
wadding tru it on a regular base is to time consuming.

Is there a way or tool to do this?

TIA,

Fred Blum

 

[Vera Noest [MVP]]

You can filter and export the Security Events once a month to a
tab-delimited textfile for further processing. This can easily be
automated with a small script.

Or you could make your own, very simple logon report by adding a
line to your TS-specific login script:

echo %username% %clientname% %date% %time% >> logon.log

195461 - How to Set Up a Logon Script Only for Terminal Server
Users
http://support.microsoft.com/?kbid=195461

 

[Fred Blum]

Thanks alot!
Can this procedure be used with a TS logoff aswell?

for example:
TSlogon.cmd
echo logon %username% %clientname% %date% %time% >> logon.log

and

TSlogoff.cmd
echo logoff %username% %clientname% %date% %time% >> logon.log

What other system variables are available for use? For example is the
connecting remote IP adress available aswell?

Or is there a way to get this from ISA server?
For example like "ALERT_PARAMETER_1"? From ISAgeek.com/J. Harrison's
Blockattacker script: "This script will grab an IP from a temprorary
environment variable created during ISA alert activation called
"ALERT_PARAMETER_1" and then create a packet filter that blocks all traffic
to / from this IP address on the default ISA external IP".

Thanks,

Fred Blum

 

[Vera Noest [MVP]]

Sure, but then you have to define a logoff script. Can be done in a
GPO.
To see all environment variables, start a command prompt within
your TS session and type "set | more" (without the quotes).