need to track RDC logins

[Guest Cindy B]

I need to be able to track all RDC connections to our Windows 2003 servers.

I've been trying to find a way to narrow down an event log -ID- that will

allow me to do that. I've tried Security - information - 552, which gives me

what I need -connection/time/userID/source workstation , but it also reports

a lot of system acitivty. We have Vendors with access, but need to document

all of their connections. Is anyone currently doing this or anything

similar, by filtering the event logs? If so can you tell me what log IDs

you're having success with.

We do have a server monitoring software - but it has limited filtering

capabilites. Log- source - category and Event ID. I'm hoping to be able to

get what I need with that software.

Thanks in advance for your time and help! Any recommendations would be

appreciated!

Cindy

--

Cindy B