Re: RWW Timing

Hi Martin,

Thanks for using the SBS newsgroup!

For your description, I understand that you want to monitor when and how
long clients logon to the server through RWW site. If I am off base, please
don't hesitate to let me know.

First I would like to explain how RWW works when a remote client connects
to an internal Windows XP or Terminal Server computer. The following is the
process:

1. User navigates to the Computer Selection page of the Remote User Portal
in a web browser, and is prompted to download the stanard Terminal Services
ActiveX Component, if necessary.

2. SBS queries the Active Directory for all internal client computers
running an OS that supports Remote Desktop and provides the list to the
user.

3. User selects a computer from the list and presses Connect button.

4. Server listens on TCP port 4125 which is already opened by firewall.

5. SBS creates a connection to the internal client on port 3389 which is
designed for TS and Remote Desktop.

6. The TS ActiveX Control downloaded and installed on the external client
creates a TS connection to the SBS server on port 4125.

7. SBS Server forwards the connection to the internal Remote Desktop client
or TS server as a TS/Remote Desktop client.

I. After understanding the RWW/Remote Desktop process, you will know that
after RWW traffic entered internal network, it will use terminal services
and do RDP process, so we can use Terminal Services Manager to monitor
terminal session. But it can not tell which one session from the RWW, which
one from VPN or RDP session. To do this, you can refer to the following:

Type 'TSadmin' in command line to open Terminal Services Manager console.
In the console, you can view detail information about terminal sessions.

If one session connect to the computer shows user name and computer name,
the connection should be from internal computer.
If one session connect to the computer shows user name but not the computer
name, the connection should be from external computer.

II. If you want to monitor which users have logon to the server when it
run. You can check this information in Event Viewer.

Start -> Administrator Tools ->Event Viewer -> click Security in Event
Viewer panel.

*Note: you need enable 'Audit account logon Events' group policy. By
default the group policy is enabled.

III. You can also monitor them from IIS log. Please follow below steps to
enable IIS log and check it:

a. Open IIS MMC, right click Default Web Site and then click Properties.
b. Click Website tab and then check Enable logging.
c. Stop the Default Website and rename the existing IIS log files under
C:\WINDOWS\system32\LogFiles.
d. Restart the Default Website.

However I would like to provide more information to monitor online
connection sessions:

I. If you want to monitor which users are accessing shared resource, you
can check the following information.

Server Management | Advanced Management | Computer Management | System
Tools | Shared Folders.
You click the sessions and open files item to view which users from which
computer are accessing which information.

II. If you want to monitor which users are accessing the server included
remote desktop connection, you can check information in Task Manager
Console.

Method 1:
Right-click Taskbar in the bottom of the screen and click Task Manager to
open Task Manager Console. And then you click Users tab to view information.

Method 2:
Type 'TSadmin' in command line to open Terminal Services Manager console.
In the console, you can view detail information about terminal sessions.

Hope above information helps! If you have any further concern or question
about the issue, please feel free to let me know. I am looking forward to
you!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>From: "Frank McCallister SBS MVP" <anonymous>
>References: <uzN0RN37FHA.3804@xxxxxxxxxxxxxxxxxxxx>
>Subject: Re: RWW Timing
>Date: Tue, 22 Nov 2005 09:13:31 -0600
>Lines: 23
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>X-RFC2646: Format=Flowed; Response
>Message-ID: <eM#oOd37FHA.2816@xxxxxxxxxxxxxxxxxxxx>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: adsl-068-209-195-008.sip.pns.bellsouth.net 68.209.195.8
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:224619
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Do you have ISA installed?
>
>--
>Frank McCallister SBS MVP
>COMPUMAC
>"Martin Hazell" <martin.hazell@xxxxxxxxxxxxxxx> wrote in message
>news:uzN0RN37FHA.3804@xxxxxxxxxxxxxxxxxxxxxxx
>> Does anybody know of an easy programme of monitoring when users log into
>> and out of RWW? Quite a few of our users will ocaasionally log in from
>> home of an evening time, but would like to know when they are doing it,
>> and for how long? Ideally, there should be a log file produced with the
>> following columns: username, date/time logged in, date/time logged out.
>>
>> I am aware that you can see the average session length and who has been
>> into the server through Server Managment, Reporting and Monitoring, but
it
>> doesn't give enough detail for what I would like to do.
>>
>> Many thanks in advance
>>
>> Martin
>>
>
>
>

.