Re: Remote Desktop Connection logs

From: Sooner Al (SoonerAl_at_somewhere.net.invalid)
Date: 10/04/04 

Date: Mon, 4 Oct 2004 16:24:44 -0500

If you expand the properties for the 528 event and scroll down in the "Description" window and click
on the "For more information" URL. The resulting windows lists the various logon types. You can test
against that, noting the time for each login attempt using Remote Desktop, by providing wrong
passwords for example to see now logging works... Of course this presumes you setup the audit policy
to also log failures... 

-- 
    Al Jarvi (MS-MVP Windows Networking)
Please post *ALL* questions and replies to the news group for the mutual benefit of all of us...
The MS-MVP Program - http://mvp.support.microsoft.com
This posting is provided "AS IS" with no warranties, and confers no rights...
"Toybreaker" <toybreaker at gmail dot com> wrote in message 
news:782A9A0F-E667-4328-BFA1-6CC25547A3AD@microsoft.com...
> Thanks for the info. I tested it and found the event. So a 528 with a logon
> type of 10 will always be a RDC or TS logon? What i need to know is if the
> client keeps any logs of attempted connection whether succesful or failures.
>
> "Sooner Al" wrote:
>
>> Look in the Event Log (Security) for a Logon/Logoff Event 528. It should have a Logon Type 10...
>>
>> You can setup an Audit Policy using the Group Policy editor to log logon  success and failures. 
>> Go
>> to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer 
>> Policy ->
>> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
>> Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
>> desired. Note, some folks have XP boxes setup to login without a password. Logging in
>> without a password counts as a "failure". This results in the security log filling up very fast 
>> if
>> you log failures and have a user without a password. I fell into that trap while testing a new XP
>> Pro box once. The result is you can not login normally. Also note, not having a password is
>> a potential and probable security risk.
>>
>> The event log can be viewed by going to "Start -> Control Panel -> Performance and Maintenance ->
>> Administrative Tools" and click on "Event Viewer".
>>
>> -- 
>>     Al Jarvi (MS-MVP Windows Networking)
>>
>> Please post *ALL* questions and replies to the news group for the mutual benefit of all of us...
>> The MS-MVP Program - http://mvp.support.microsoft.com
>> This posting is provided "AS IS" with no warranties, and confers no rights...
>>
>> "Toybreaker" <toybreaker at gmail dot com> wrote in message
>> news:053BBE00-AE37-4B6B-85B4-40FFB72C4B67@microsoft.com...
>> > Does RDC keep ANY logs at all. errors, connections made...recent connections?
>> > anything at all would be helpful as i have searched and can not find any as
>> > of yet.
>> >
>> > Thanks all!
>> > Toybreaker at gmail dot com
>> > -- 
>> > NEXT!!!
>>
>>

Relevant Pages

  • Re: Remote Desktop Connection logs
    ... The resulting windows lists the various logon types. ... > Al Jarvi (MS-MVP Windows Networking) ... >> client keeps any logs of attempted connection whether succesful or failures. ... >>> You can setup an Audit Policy using the Group Policy editor to log logon success and failures. ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: How to force a logoff in a logon script?
    ... Windows has a registry key that governs which UI will be presented ... the unauthorized user cancels the logon dialog and goes away ... system, but complains that there was no cancel button, only an OK ...
    (microsoft.public.windows.server.scripting)
  • Re: When utilizing "Switch User" the music "NEVER" Stops!
    ... 2004 Windows MVP "Winny" Award ... Switch User, changing logons and checking the top of Zone ... >logging onto the 2nd logon and then logging off and back ... >>NEVER stopped thru any of the screens ?? ...
    (microsoft.public.windowsxp.general)
  • Re: Huh? "Login failure: the user has not been granted the requested logon type at this compute
    ... I'm a pretty experienced Windows user and programmer, ... the user has not been granted the requested logon type ... on the appropriate OU to see the Group Policy for that OU]. ... > administrators' group to the domain controller. ...
    (microsoft.public.security)
  • Re: Server 2K3 Remote Desktop Access - is this right place?
    ... All roads for that particular error of 'You do not have access to logon to ... On Windows Server 2003, launch GPEDIT.MSC from Start -> Run. ... Drill down and expand the following for Local Computer Policy: ... > Strange - when I activate the Remote Desktop Terminal from the server, ...
    (microsoft.public.win2000.advanced_server)