Re: How to know if someone accessed using RDP

Was he logging in with a domain account?
If so, check the security logs on your domain controllers. Look for
authentication from his user account.
Was he logging in with a local computer account?
If so, check the security logs on the server he was logging into.

To do so, right-click on My Computer and select "Manage". Open "Event
Viewer". Go to "Security". You can look through the logs to find
authentication for his account. You can use the filter tools to make your
search more efficient.

How does one access your network remotely? Do they have to VPN in first?
If so, check the VPN access logs.
This will most likely not apply if you have your remote desktop available to
the public without authenticating to VPN first.

--
Ken Aldrich
DSRAZOR for Windows
Visual Click Software, Inc.
www.visualclick.com

"JM" <jm@xxxxxxxxx> wrote in message
news:o6evg.30122$vl5.7062@xxxxxxxxxxxxxxxxxxxxxxxxx
We have Windows 2000 server (SP4), and our IT guy just left under
questionable circumstances. In the couple of days after he left but
before
we changed the server password, we think that IT person used remote
desktop
to get in a mess with some things.

Is there a log file that would document his activity, at least show us a
connection date and time?


thank you,


jm




.

Relevant Pages

  • Re: Integrated Windows Authentication Fails from Client PCs
    ... is the application pool account of the website running under a domain account ... to allow access through Integrated Windows Authentication. ... the Web Services from an RDP session with the server it works. ... The logs don't show anything usefull. ...
    (microsoft.public.sharepoint.portalserver)
  • Admin lockout bug?
    ... I get failure logs from the Security logs ... "Account locked out". ... I read in some newsgroup post somewhere that it's a bug in win2k that will ...
    (microsoft.public.win2000.security)
  • Re: AD User Account Illusions
    ... We have the logs set at maximum which is 4,194,240k This ... >the available disk space allotted to your security logs ... >>I have an account that continually dissapears out of AD ...
    (microsoft.public.win2000.active_directory)
  • Re: Win2003 loses AD user account
    ... If a domain administrator logs onto a domain workstation and the ... See if the security logs on the domain controller can pinpoint ... have to correlate logon events in the security log to the account deletion ...
    (microsoft.public.windows.server.security)
  • Re: Security log is blank?
    ... will be shown in the log on the local computer unless a user logs into the ... the ex employee has his account disabled. ... The security logs on this pc have not been ...
    (microsoft.public.win2000.security)