Correlate terminal services sessions with TCP established connections

[ESquared]

I needed to find out who was connected to a certain server using our corporate LAN today using RDP. I was only able to trace it as a connection from another server which people from outside can connect to. 10 or more users were connected and I lost the trail due to lack of knowledge.

I used netstat to find RDP connections using port 3389, so I knew the outgoing and destination ports on both servers, which is how I knew the source of the session from ultimate destination. The question then was on the first hop backward, how can I correlate an existing ESTABLISHED CONNECTION in this list to a terminal services client connection? I tried using ProcessExplorerNt thinking I might find a handle or value of some sort which could be helpful, but before I could really explore everything, the person logged out.

I want to know what to do so next time I need to know this information in a hurry, I will be able to do it.

Everything is complicated by the fact that just knowing the username of the logged-in session is not enough, I need to trace it all the way back to the originating IP from outside our LAN. Also, the remote desktop connection to the final server was using the /console switch, further complicating detecting who was logged in as sometimes you just see the login name of the console session instead of the remote user.

Does anyone have ideas for me, books to read, web sites to visit that would help me with tracking this down? I did some web searching and the search terms are so generic that I either get overwhelmed with hits or I get general how-to information, or citrix junk.

 

[ESquared]

Is this the wrong forum for the question? No answers in four days... ?

 

[Roadki11]

Probably need to start by turning on auditing if its not already enabled. then the first server they connect to will log when they logged in, the user name, and source ip. then i guess you would look at the logs on the next server in they hoped to and check for the user name with source ip of the first server. best i got for ya.

RoadKi11

 

[sparkbyte]

As road kill suggests, turning on auditing, both success and failure, is your first step.

The Win Security Event log will have entries for every remote connection made to the server with the source name and IP.

If all your connection from "outside" come in through a NAT'ing firewall, and you want to track to their source, you will need to combine/compare the logs to get to the actual Internet (external) IP address of the incomming connection.

Keep doing this until you get to source. Depending on importance you may need to contact an ISP or 2 and tell them that you are investigate suspicious activity on your servers originating from their network and would like their assistance in tracking the matter down further.

Main thing here is that RDP by default encrypts it's traffic so the eventlogs become very important in your search.

Hope this helps.



Thanks

John Fuhrman
Titan Global Services

http://www.titangs.com

 

[ESquared]

Thanks for your ideas. Auditing of successful connections should work--I did check this but only security failures were being logged.

But there has to be a way, even if only programmatically, to see which process has open which TCP connection, and then correlate the process to the particular user! Should I be asking this in the Windows API forum?