RE: Logging for Remote Web Workplace?
- From: v-branee@xxxxxxxxxxxxxxxxxxxx ("Brandy Nee [MSFT]")
- Date: Wed, 08 Feb 2006 07:01:51 GMT
Hello Rob,
Thank you for posting to the SBS Newsgroup.
Thanks a lot for Jerry's information sharing!
I understand that you want to know how to track users log on. If I have
misunderstood your concern, please let me know.
Please see my reply for each of your questions:
1. To track remote users to use RWW:
Based on my research, if your users use RWW to logon to network, there will
be following event in the event logs.
Event ID: 680
Source: security
Category: Account Logon
In addition, even ID 540, 552 and 576 will also be logged in to security
event logs. Please see:
Auditing User Authentication
http://support.microsoft.com/?id=174073
Event Message:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/w2kmsgs/545
9.asp
Logon Type 10 means that User logged on to the computer remotely using
Terminal Services or Remote Desktop. Please see:
Audit logon events
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Serve
rHelp/e104c96f-e243-41c5-aaea-d046555a079d.mspx
With the information, you could know the users log time, but the source
computer will not be displayed since the client computer use IE to logon to
IIS pages. If you want to know more information about the IIS session, you
could use IIS logs.
a. Open Internet Information Services (IIS) console\<Server name>. Right
click ''Default Web Site'' to choose ''Properties''.
b. Under the ''Web Site'' tab, check the option ''Enable Logging''.
c. With ''W3C Extended Log File Format'', click ''Properties''.
d. Under ''General Properties'', make sure ''Use local time for file naming
and rollover'' is CHECKED.
e. Switch to the ''Extended Properties'', and then select to enable All the
logging Options.
f. Click OK to apply the modification.
g. By Default, the log files are created in the
''%systemroot%\system32\logfiles\W3SVC1'' folder.
You can send the log file to us to analysis for you.
2. To know users and the computers who are currently logging to the domain:
There are several methods can achieve your goal:
a. Check "Sessions" in Computer Management. Expand to Computer
Management\System Tools\Shared Folders\Sessions. Then you can see who is
using a CAL.
b. Technically speaking, "net session" will show current connections from
clients. However, even the user is logging on domain, the client will not
always build and keep connection to DC. To keep track of information about
every login in a domain, we can use LimitLogin.exe.
Utility Spotlight
http://www.microsoft.com/technet/technetmag/issues/2005/05/UtilitySpotlight/
default.aspx
To download LimitLogin.exe:
http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c359c
c0842/limitlogin.exe
Hope this information helps. If you have any further questions or concerns,
please feel free to let me know. I am glad to be of further assistance!
Best regards,
Brandy Nee
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
From: mydejamail@xxxxxxxxxxx10:36:44 GMT)
Newsgroups: microsoft.public.windows.server.sbs
Subject: Logging for Remote Web Workplace?
Date: 7 Feb 2006 02:36:39 -0800
Organization: http://groups.google.com
Lines: 3
Message-ID: <1139308599.111405.112900@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
NNTP-Posting-Host: 82.70.183.14
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Trace: posting.google.com 1139308604 18334 127.0.0.1 (7 Feb 2006
X-Complaints-To: groups-abuse@xxxxxxxxxxrv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1,gzip(gfe),gzip(gfe)
NNTP-Posting-Date: Tue, 7 Feb 2006 10:36:44 +0000 (UTC)
User-Agent: G2/0.2
X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
Complaints-To: groups-abuse@xxxxxxxxxxTK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!t-onli
Injection-Info: g47g2000cwa.googlegroups.com; posting-host=82.70.183.14;
posting-account=nGYZNwwAAAAD1xD0dq8mVzHMHQG6FDsS
Path:
ne.de!news.glorb.com!postnews.google.com!g47g2000cwa.googlegroups.com!not-fo
r-mail
Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:242728
X-Tomcat-NG: microsoft.public.windows.server.sbs
Is there any kind of logging for Remote Web Workplace - if so where are
they kept?
.
- References:
- Logging for Remote Web Workplace?
- From: mydejamail
- Logging for Remote Web Workplace?
- Prev by Date: RE: Problem adding win2k client to SBS domain
- Next by Date: RE: Logging for Remote Web Workplace?
- Previous by thread: Logging for Remote Web Workplace?
- Next by thread: RE: Logging for Remote Web Workplace?
- Index(es):
Relevant Pages
|
|
