Windows 2003 Audit Questions 1

[NightSkull]

Hi All,

Rookie in administration in Win2k3 Server needs your advice. In the server itself,
1. How do I know who is currently logged in remotely using remote desktop/terminal service?
2. Anywhere I could see all the past users who logged in?
3. If someone logs in remotely and if they logged in as administrator, is there any way to track the IP address or anything useful? Like an audit trail perhaps?

Thanks to all for your time!

Regards,

NS

 

[EnochL]

1. Start -> Run -> tsadmin

2. This is going to depend upon your logging setup, if you have Success/Fail Security logging turned on for logins, and sufficient space in your Security Event Viewer (as well as an appropriate backup) then you can see it in the Security Log. Did you have an auditor ask you for a list of every user that ever logged in? That seems a bit ludicrous...
3. There are a number of ways, but we've found the easiest is to disable TS and RC logins, and make people use something like Dameware, which logs everything into the System Log.

 

[NightSkull]

Thanks EnochL!!!