Tracking/Logging RDP sessions Logon/Logoff activity

[MockY]

I am looking for a way to log users login and logoff activity per RDP session. I am running thin clients on the network now. I created this thread before:

http://www.tek-tips.com/viewthread.cfm?qid=1251782

but it does not seem to work anymore. Besides, I would like a nicer way of doing so. It should be simple, when a user starts a RDP session, that is logged in a file and when he or she is logging out, the same will be tracked in the same file, making it easy for me to see how many hours or minutes in total a specific user has been online per 2 weeks.

Does anyone have any idea?

 

[IllogicallyLogical]

What about just configuring an Audit Policy? The events will be logged in the Security Log of Event Viewer. Whenever you want to know the specific information for a particular user, just filter through the events by opening Event Viewer, clicking on View and selecting Filter. Then you can filter by the specific user, event type - Security, category - Logon/Logoff, and the span of time you are looking to gather your information for.

- Audit logon events

http://technet2.microsoft.com/windo...e243-41c5-aaea-d046555a079d1033.mspx?mfr=true

Joey
A+, Network+, MCP

 

[astaylor]

i use this method and it works very well. i have it set to log every user logon/logoff event in seperate csv log files based on username, but it can be modified to your liking.

link:

http://msmvps.com/blogs/kwsupport/archive/2005/02/24/36942.aspx

-drew

 

[MockY]

Thank you astaylor. I used similar technique to keep track of login/logoff events through the DC and tried to appliy it again but to no success.
I will use your example step by step since it is exactly what I am looking for. Windows built in audit is worthless and not even worth mentioning. Thank you so much.

 

[DThornton123]

We do what Drew is doing, plus we also log these events to a file that's named based on the computer name. It comes in very handy when trying to determine who was logged onto a system at a specific time.

 

[MockY]

As it turns out, %time% by itself adds a space when ever the time has only one digit for the hour.
Here is a visual:

ON,MockY,Tue 11/20/2007, 8:13:14.12
ON,MockY,Tue 11/20/2007,14:11:26.89

Instead of a zero or nothing, there is a space in front of the 8. I would like a 0 there. I want two digits at all time, is that possible?