is there a way to log the IP address of RDP clients? 1

[PPettit]

Is there a way to grab the IP address of RDP clients that connect to my Terminal Server? I'd like to be able to log them or maybe even do some address-based scripting.

 

[ShackDaddy]

The place that first comes to mind is the security log. It logs all logons, and when an RDP client connects and authenticates, an event is generated that includes the client's IP address. I use this log regularly to determine source IPs for RDP clients.

ShackDaddy

 

[mrdenny]

This would work, kind of. When they log in, have a batch file run.

netstat -a -n | grep 3389 >> log.txt

This will pull the line for everyone connected to port 3389 (the RDP port) and log it to log.txt. You'll need to find grep.exe (use google).

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[PPettit]

Thanks, ShackDaddy. I've looked in the event log before but somehow managed to overlook the proper entry every single time.

In case anyone is interested, the Event number to look for is 528.