Windows Forum

Ask something
Discussion Locked

Audit Termserv login only

0 helpful
3 replies

by typamfiloff

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

At the moment I am only interested in auditing success/failure of termservlogons. Is there a way to do this without auditing every single domain logon as well?? Even more specifically I'm interested in those who logon over the internet.

thanks

3 replies

by joseph moore

Technet article Q140714 lists the different logon Event Viewer message types. Here is the list:

Interactive logon Event ID 528 Type 2
Interactive logoff Event ID 538 Type 2
Network logon Event ID 528 Type 3
Net Use connection Event ID 528 Type 3
Network logoff Event ID 538 Type 3
Net use disconnection Event ID 538 Type 3
Autodisconnect Event ID 538 Type 3

Unfortunately, this is not gonna help you much! I just did a TS connection to a server, and it wrote in the server's Security log Event ID 528 Type 2.
Now, when I log into my workstation, it ALSO writes Event ID 528 Type 2.
So, looks like a TS connection is treated the same way as a normal login when you are standing at the box! So, this is not the news you were looking for.

Sorry for not having good news.

by typamfiloff

No its not the answer I was looking for ...but certainly helpful. Thanks and enjoy the points :)

This discussion is closed to new replies.