Windows Forum

Ask something
Discussion Locked

Logging Terminal Services connections

0 helpful
4 replies

by cburwell

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Is there a way of logging terminal services connections. I have been asked to set this up with the ability of logging who has been into the system. Thanks in advance

4 replies

by omnicef

1. Click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
2. In the Terminal services Configuration box, right-click RDT-Tcp, and then click Properties.
3. In the RDP-Tcp Properties box, click the Permissions tab, and then click Advanced.
4. In the Access Control Settings for RDP-Tcp box, click Add.
5. In the Look in box, click the name of your server, click Everyone, and then click OK.
6. In the Auditing Entry for RDP-Tcp dialog box, click to select the Successful check box and the Failed check box for the following entries:? Remote Control
? Logon
? Logoff

7. Click OK three times.
8. Close the Terminal Services Configuration window.
To turn on the functionality to log terminal services and remote desktop session events, you must add LogTSLogOff and LogRemoteControl registry entries to the registry. To do this, follow these steps:1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
3. On the Edit menu, point to New, and then click REG_DWORD Value.
4. Type LogTSLogOff, and then press ENTER.
5. Right-click LogTSLogOff, and then click Modify.
6. Type 1 in the Value data box, and then click OK.
7. On the Edit menu, point to New, and then click REG_DWORD Value.
8. Type LogRemoteControl, and then press ENTER.
9. Right-click LogRemoteControl, and then click Modify.
10. Type 1 in the Value data box, and then click OK.
11. Quit Registry Editor
Windows 2000 Service Pack 4 (SP4) adds the EventMessageFile registry entry that is located under the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService
Additionally, you must append the EventMessageFile entry with the following value, including the leading semi-colon :
;%SystemRoot%\System32\sp3res.dll

by mlerner123

Omnicef,

I followed your directions on my Win2003 R2 SP2 server, except for the last step (#11) - since it was not clear to me if this applies to Win2003. Now I see a log entry that shows when a remote desktop user to the server logs off the connection, and that's great. However, there is no log entry for when a remote desktop user logs ON to the server - there's only one when he logs off.
I took a wild guess and added a registry value called LogTSLogOn, but that didn't work either.
Do you know how to get the logon time written to the log as well? Is that what the last step of your instructions does?

Thanks,
-Michael

by john

Had mixed results same as Omnicef
I Now I see a log entry that shows when a remote desktop user to the server logs off the connection, and that's great. However, there is no log entry for when a remote desktop user logs ON to the server - there's only one when he logs off.
I took a wild guess and added a registry value called LogTSLogOn, but that didn't work either.
Do you know how to get the logon time written to the log as well? Is that what the last step of your instructions does?

Thanks,
-Michael

This discussion is closed to new replies.