up vote 2 down vote favorite
share [g+] share [fb]

I specifically asked someone not to remotely access a computer running Win 7 Pro 32bit.

Now I see on the computer that Remote Access is fully set up to their laptop.

Is there a log or record somewhere in Win 7 of the times, dates and/or files they have remotely accessed via their laptop? I would like some proof before I confront them.

link|improve this question
feedback

3 Answers

up vote 1 down vote

It's not really a log file and I only had a WinXP system to verify it, but I assume the behavior hasn't changed that much: The remote desktop application (mstsc.exe) on the local machine remembers the hostname/ip address of the last few remote hosts that one connected to.
Just start it and then you should be able to see entries in the drop down list.

Using this data, there is no way to tell when the login happened and it can therefore only give an indication.

link|improve this answer
feedback
up vote 1 down vote

The short answer, not by default.

However if the firewall is on and logging on the firewall is enabled on the host machine, you can see logon attempts from remote machines in the Event Viewer under the Security Log. They normally have an Event ID of 10 and shows the machine name that connected at the time.

link|improve this answer
The firewall does NOT have to be turned on to enable logging via the security log and event viewer -- you just have to edit the policies to turn on logging of remote access. – David W. Fenton Feb 5 '11 at 1:56
@David Interesting. We were never able to get it to work without the firewall. – Diago Feb 5 '11 at 6:19
Thanks a lot guys, very useful info. – Mel Feb 5 '11 at 8:14
Are you going to Control Panel | Administrative Tools | Local Security Policies | Local Policies | Audit Policy? – David W. Fenton Feb 6 '11 at 23:45
@David. Yes. We spent about a week trying different things. Even Microsoft couldn't get it working. – Diago Feb 7 '11 at 6:36
show 1 more comment
feedback
up vote 1 down vote

I found this very helpful page about Windows 7 event log

As well as events 4624 (logon) and 4634 (logoff), I believe 4778 (session connect) and 4779 (session disconnect) are useful for monitoring remote desktop sessions.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.