Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I may be hiring some remote employees and would like a way to track that they are working when they say they are.

Is there a way to track how and when someone connects via remote desktop to a computer? Is there a way remote desktop can record or piggyback/watch a session to see the work done?

When I say remote desktop, I mean the default RDP that comes with Windows.

Basically, I want to have some sort of backup for the employee so when he says he works 9-5, I can verify that he was on the computer doing something.

EDIT: Adding here as this came up, that the machines I wish to track that are getting remoted into are Windows XP machines.

Thanks.

share|improve this question
2  
if you want to just see when they logon and off you can use auditing. But just because they log on and off does not mean they are working. –  Logman Mar 7 '13 at 3:28
    
just a thought, if you have a screen saver enabled, you can also use auditing to capture the event. If the screen saver fires does the rdp connection lose connection? –  Logman Mar 7 '13 at 3:58
    
I think VNC sessions or a similar technology could be used to observe the desktop in real time. Using this to record multiple computers for long periods is much harder to do however. –  washbow Mar 7 '13 at 4:20
    
Due to disk space I assume? –  SolidSnake4444 Mar 7 '13 at 4:36

1 Answer 1

Audit Policy for Logons on the computer - you can do it on a single workstation editing its Local Security Policy. Active Directory domain? use group policy...

Goto Computer Management (right click over My Computer) System Tools, Event viewer and window logs, select Security. (win7)

Check Events in Security for Event Code = 528 (loggedOn) and/or Logon Type = 10 (Remote) Select the event and then select "Attach Task to this event" and go thru the wizard and select "send an email" on the event (must have a smtp server info to use). Then whenever they logon you get an email. Do it for the logoff event too. Of course you do not have to do this task/email. You would have to manually check the logs and read/search for the events. Would be a lot easier to get the emails than checking them yourself.

The image below shows normal log on / off events, you will need to select the 528 events with the type 10 code-

enter image description here

share|improve this answer
    
So in your picture, where it says 4624, I should actually be looking for code 528 in that space? Does sending an email require an email program to be installed, such as outlook? I'm not familiar with how the screen saver affects this. Were you suggesting in the comments above that the screen saver has it's own code that I can check to determine if the user is idle? Thank you very much for your comments so far. –  SolidSnake4444 Mar 7 '13 at 4:05
    
I looked real fast in the attach task and the email section was asking for smtp server....what would I use for that? –  SolidSnake4444 Mar 7 '13 at 4:20
    
Oh by the way, the machine they are remoting into is an XP machine, I did not see these options in the eventvwr on the XP machine. I'm still interested in the answers for my previous comments as some machines are windows 7 but most are XP. Any XP solution for the same thing? Logon tracking. –  SolidSnake4444 Mar 7 '13 at 14:50
    
are the comps on a domain? 2003? 2008? 2012? workgroup? –  Logman Mar 7 '13 at 16:36
    

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.