Terminal Server logging

[massctrl]

Hi,

1 - In a 'out of the box installation' is there a log kept for logons, failed logons with source ip's and other activities for Terminal Server?

2 - Is there a possibility to do so without third party tools ?

Thanks in advance!

 

[TechMerlin]

As for the failed logons, these are kept in the security log in Event Viewer

Mark Morton, MCSA, MCP, SNA, CCA

 

[alichamberlain]

You can use the Local Security Policy | Security Settings | Local Policy | Audit Policy to set up logging. There are various options in here but if you tick the boxes for Success & Failure under the Audit Logon Events option your successful & failed logon attempts will show up in your Security log.

 

[massctrl]

Ok i found it,

but that's a joke no source ips how can i legally do something with this to prove a break-in.

pitty