39

I connect to my work PC via VPN/RDP and I would like to find a log file on my work PC that would include some information on when I used it last, from where my connection originated and how long it lasted. Where in Windows 7 would I look to find that out?

1
  • Shouldn't this be on serverfault?
    – Pacerier
    Jun 26, 2015 at 7:38

6 Answers 6

49

If you look at the event viewer as the administrator there are server logs but not for login/logout as far as I know.

Please check the Event Viewer tree on the left side under "Applications and Services Logs -> Windows -> TerminalServices-*" where * is all of the logs there. I think you are most interested in the TerminalService-LocalSessionManager Operational log. Event ID 21 will provide the IP address of the incoming connection.

There is also a "RemoteDesktopServices-RemoteDesktopSessionManager" node in the event viewer tree on the left side under "Applications and Services Logs -> Windows". Only the Administrator role is allowed to view the file I believe. Please confirm and let me know if this addresses your use case.

Maybe try this for logging login/logout as well: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/aptopnode.mspx?mfr=true

1
  • 3
    Actually either TerminalService-LocalSessionManager Operational or TerminalService-RemoteConnectionManager Operational work for me. I can see the username and the dhcp IP from there. Thanks.
    – Darius
    Apr 5, 2012 at 23:26
7

Look under 'Application and Services Logs' > 'Microsoft' > 'Windows' > 'TerminalServices-ClientActiveXCore' > 'Microsoft-Windows-TerminalServices-RDPClient/Operation' ,

This log will have events which contain the server name which the end user attempted to connect RDP into.

1
  • and if that is empty, you may be lucky and have entries in TerminalServices-RemoteConnectionManager.
    – mbx
    Jun 7, 2017 at 8:02
2

I can't tell you how to check from your work machine when you established a VPN as presumably it isn't the VPN server (?). However, if you're using Remote Desktop Connection to control that work PC you may be able to pull the logon / logoff times from the Event Viewer.

Look in the Security logs for those. RDP logons are an Event ID 4624 but just searching for 4624 won't work. Within the event you need the Logon Type value to be "10" and the SecurityID value to be yours. Not sure how to filter those...

2
  • This works as well but the log that I can get from Jarod's answer are easier to digest.
    – Darius
    Apr 5, 2012 at 23:44
  • You can open the XML tab on the Filter dialog, check the Edit manually box and enter <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and Data=10]]</Select> </Query> </QueryList>.
    – mynetx
    Sep 1, 2019 at 16:58
1

I found the information in the Event Viewer under Windows Logs/Security you will see under task category logon and logoff events.

3
  • Not entirely sure where you were looking but that area does not provide the information I was asking for.
    – Darius
    Jul 17, 2014 at 19:39
  • 1
    RDP can also reconnect to an existing session, in which case there won't be a logon event.
    – Ben Voigt
    Jul 17, 2014 at 20:37
  • @BenVoigt, The logon logoff might also not be from RDP right?
    – Pacerier
    Jun 26, 2015 at 7:44
1

In your case, you need to review TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs from your computer.

You can also check an excellent third party tool called SysKit, formerly Terminal Services Log. It will generate you all sort of reports from logs and will save you a bunch of time if you want to get all of the details about RDP connections and other stuff.

Please note: I am affiliated with Acceleratio, the makers of the tool mentioned above, so I might be a little bit biased here.

2
  • 1
    the syskit price is a little steep :(
    – sdjuan
    Jan 20, 2016 at 17:21
  • If you mentioned a tool that was open source as well in your answer I would like it even more :)
    – Darius
    Jul 4, 2016 at 6:49
1

Use the command quser to show sessions.

Then you will see something like ID 1 or 2 or 4. Then type Logoff 4 to log off that session.

You can also type query session or qwinsta (both are the same thing) Show's who's on and what port is listening etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .