31

I connect to my work PC via VPN/RDP and I would like to find a log file on my work PC that would include some information on when I used it last, from where my connection originated and how long it lasted. Where in Windows 7 would I look to find that out?

  • Shouldn't this be on serverfault? – Pacerier Jun 26 '15 at 7:38
39

If you look at the event viewer as the administrator there are server logs but not for login/logout as far as I know.

Please check the Event Viewer tree on the left side under "Applications and Services Logs -> Windows -> TerminalServices-*" where * is all of the logs there. I think you are most interested in the TerminalService-LocalSessionManager Operational log. Event ID 21 will provide the IP address of the incoming connection.

There is also a "RemoteDesktopServices-RemoteDesktopSessionManager" node in the event viewer tree on the left side under "Applications and Services Logs -> Windows". Only the Administrator role is allowed to view the file I believe. Please confirm and let me know if this addresses your use case.

Maybe try this for logging login/logout as well: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/aptopnode.mspx?mfr=true

  • 3
    Actually either TerminalService-LocalSessionManager Operational or TerminalService-RemoteConnectionManager Operational work for me. I can see the username and the dhcp IP from there. Thanks. – Darius Apr 5 '12 at 23:26
3

Look under 'Application and Services Logs' > 'Microsoft' > 'Windows' > 'TerminalServices-ClientActiveXCore' > 'Microsoft-Windows-TerminalServices-RDPClient/Operation' ,

This log will have events which contain the server name which the end user attempted to connect RDP into.

  • and if that is empty, you may be lucky and have entries in TerminalServices-RemoteConnectionManager. – mbx Jun 7 '17 at 8:02
1

I can't tell you how to check from your work machine when you established a VPN as presumably it isn't the VPN server (?). However, if you're using Remote Desktop Connection to control that work PC you may be able to pull the logon / logoff times from the Event Viewer.

Look in the Security logs for those. RDP logons are an Event ID 4624 but just searching for 4624 won't work. Within the event you need the Logon Type value to be "10" and the SecurityID value to be yours. Not sure how to filter those...

  • This works as well but the log that I can get from Jarod's answer are easier to digest. – Darius Apr 5 '12 at 23:44
  • You can open the XML tab on the Filter dialog, check the Edit manually box and enter <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and Data=10]]</Select> </Query> </QueryList>. – mynetx Sep 1 at 16:58
0

I found the information in the Event Viewer under Windows Logs/Security you will see under task category logon and logoff events.

  • Not entirely sure where you were looking but that area does not provide the information I was asking for. – Darius Jul 17 '14 at 19:39
  • 1
    RDP can also reconnect to an existing session, in which case there won't be a logon event. – Ben Voigt Jul 17 '14 at 20:37
  • @BenVoigt, The logon logoff might also not be from RDP right? – Pacerier Jun 26 '15 at 7:44
0

In your case, you need to review TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs from your computer.

You can also check an excellent third party tool called SysKit, formerly Terminal Services Log. It will generate you all sort of reports from logs and will save you a bunch of time if you want to get all of the details about RDP connections and other stuff.

Please note: I am affiliated with Acceleratio, the makers of the tool mentioned above, so I might be a little bit biased here.

  • 1
    the syskit price is a little steep :( – sdjuan Jan 20 '16 at 17:21
  • If you mentioned a tool that was open source as well in your answer I would like it even more :) – Darius Jul 4 '16 at 6:49
0

Use the command quser to show sessions.

Then you will see something like ID 1 or 2 or 4. Then type Logoff 4 to log off that session.

You can also type query session or qwinsta (both are the same thing) Show's who's on and what port is listening etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.