How to record logon/off TS client.

[Guest ThomasAJ]

I want to record my remote users' logon/off somewhere. Is that possible?

 

--

Regards

Tom

[Guest Vera Noest [MVP]]

Re: How to record logon/off TS client.

 

Sure. Assuming that auditing of logon and logoff events is enabled,

it's already there. Check the security tab of the EventLog on the

server.

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>

wrote on 12 sep 2007 in

microsoft.public.windows.terminal_services:

> I want to record my remote users' logon/off somewhere. Is that

> possible?

[Guest ThomasAJ]

Re: How to record logon/off TS client.

 

Sorry but I do not know what you are referring to.

I looked at the 'Event Log' service but could not see any Security tab.

Looked at Event Viewer but no TS logging.

 

Are you able to hand hold me a little longer please.

 

--

Regards

Tom

 

 

"Vera Noest [MVP]" wrote:

> Sure. Assuming that auditing of logon and logoff events is enabled,

> it's already there. Check the security tab of the EventLog on the

> server.

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> ___ please respond in newsgroup, NOT by private email ___

>

> =?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>

> wrote on 12 sep 2007 in

> microsoft.public.windows.terminal_services:

>

> > I want to record my remote users' logon/off somewhere. Is that

> > possible?

>

[Guest Vera Noest [MVP]]

Re: How to record logon/off TS client.

 

To be able to see all logon and logoff events in the Security tab

of EventViewer (which I referred to - a little sloppy - as the

EventLog), you have to enable auditing of these events.

That can be configured on a number of levels: for the entire

domain, for the OU which the TS is located in, or only on the TS.

Whereever you decide to do this, it is a setting in the group

policy object (GPO).

 

You can find it under Computer Configuration - Windows settings -

Security settings - Local policies - Audit policy

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

*----------- Please reply in newsgroup -------------*

 

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>

wrote on 13 sep 2007:

> Sorry but I do not know what you are referring to.

> I looked at the 'Event Log' service but could not see any

> Security tab. Looked at Event Viewer but no TS logging.

>

> Are you able to hand hold me a little longer please.

[Guest ThomasAJ]

Re: How to record logon/off TS client.

 

Thanks. As far as I can see it's being logged (Event Viewer/Security) but I

did not notice it before as the log is completelly full of event #s 538 and

540 caused by 'ANONYMOUS LOGON' at the rate of 8 events per minute 24/7.

 

1. What is that about?

2. Can/should I stop it?

3. If not can I hide it?

 

many thanks

--

Regards

Tom

 

 

"Vera Noest [MVP]" wrote:

> To be able to see all logon and logoff events in the Security tab

> of EventViewer (which I referred to - a little sloppy - as the

> EventLog), you have to enable auditing of these events.

> That can be configured on a number of levels: for the entire

> domain, for the OU which the TS is located in, or only on the TS.

> Whereever you decide to do this, it is a setting in the group

> policy object (GPO).

>

> You can find it under Computer Configuration - Windows settings -

> Security settings - Local policies - Audit policy

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> *----------- Please reply in newsgroup -------------*

>

> =?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>

> wrote on 13 sep 2007:

>

> > Sorry but I do not know what you are referring to.

> > I looked at the 'Event Log' service but could not see any

> > Security tab. Looked at Event Viewer but no TS logging.

> >

> > Are you able to hand hold me a little longer please.

>

[Guest Vera Noest [MVP]]

Re: How to record logon/off TS client.

 

Difficult to say without knowing much more about your environment.

You can check the Logon Type of these events, where Logon Type 2 =

interactive and Logon type 3 = network connection.

I suspect that most of these events are of Logon Type 3.

 

You can't stop them without disabling auditing of all logon and

logoff events. You can try to use a filter in EventViewer to see only

those events you are interested in

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?VGhvbWFzQUo=?= <ThomasAJ@discussions.microsoft.com>

wrote on 14 sep 2007 in

microsoft.public.windows.terminal_services:

> Thanks. As far as I can see it's being logged (Event

> Viewer/Security) but I did not notice it before as the log is

> completelly full of event #s 538 and 540 caused by 'ANONYMOUS

> LOGON' at the rate of 8 events per minute 24/7.

>

> 1. What is that about?

> 2. Can/should I stop it?

> 3. If not can I hide it?

>

> many thanks