General discussion

Locked

Logging Terminal Services connections

By cburwell ·
Is there a way of logging terminal services connections. I have been asked to set this up with the ability of logging who has been into the system. Thanks in advance

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Omnicef In reply to Logging Terminal Services ...

1. Click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
2. In the Terminal services Configuration box, right-click RDT-Tcp, and then click Properties.
3. In the RDP-Tcp Properties box, click the Permissions tab, and then click Advanced.
4. In the Access Control Settings for RDP-Tcp box, click Add.
5. In the Look in box, click the name of your server, click Everyone, and then click OK.
6. In the Auditing Entry for RDP-Tcp dialog box, click to select the Successful check box and the Failed check box for the following entries Remote Control
? Logon
? Logoff

7. Click OK three times.
8. Close the Terminal Services Configuration window.
To turn on the functionality to log terminal services and remote desktop session events, you must add LogTSLogOff and LogRemoteControl registry entries to the registry. To do this, follow these steps:1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
3. On the Edit menu, point to New, and then click REG_DWORD Value.
4. Type LogTSLogOff, and then press ENTER.
5. Right-click LogTSLogOff, and then click Modify.
6. Type 1 in the Value data box, and then click OK.
7. On the Edit menu, point to New, and then click REG_DWORD Value.
8. Type LogRemoteControl, and then press ENTER.
9. Right-click LogRemoteControl, and then click Modify.
10. Type 1 in the Value data box, and then click OK.
11. Quit Registry Editor
Windows 2000 Service Pack 4 (SP4) adds the EventMessageFile registry entry that is located under the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService
Additionally, you must append the EventMessageFile entry with the following value, including the leading semi-colon :
;%SystemRoot%\System32\sp3res.dll

Collapse -

How to log logon times as well as logoff times?

by michael In reply to

Omnicef,

I followed your directions on my Win2003 R2 SP2 server, except for the last step (#11) - since it was not clear to me if this applies to Win2003. Now I see a log entry that shows when a remote desktop user to the server logs off the connection, and that's great. However, there is no log entry for when a remote desktop user logs ON to the server - there's only one when he logs off.
I took a wild guess and added a registry value called LogTSLogOn, but that didn't work either.
Do you know how to get the logon time written to the log as well? Is that what the last step of your instructions does?

Thanks,
-Michael

Collapse -

Reponse To Answer

by john In reply to

Had mixed results same as Omnicef
I Now I see a log entry that shows when a remote desktop user to the server logs off the connection, and that's great. However, there is no log entry for when a remote desktop user logs ON to the server - there's only one when he logs off.
I took a wild guess and added a registry value called LogTSLogOn, but that didn't work either.
Do you know how to get the logon time written to the log as well? Is that what the last step of your instructions does?

Thanks,
-Michael

Collapse -

by frane.borozan In reply to Logging Terminal Services ...

Check out this project. It has everything required:
Connection start (date and hour)
User
Duration
Total time connected
IDLE time
Active time
Disconnected session time
Connection end (date and hour)
Status

http://www.terminalserviceslog.com/

Back to Windows Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums