I wanted to know if there are any logs created on the host machine that shows that someone made a RDP connection or so? If this is possiblem then can I also see which user and what IP address was used to establish the connection or so? Thank you
Printable View
I wanted to know if there are any logs created on the host machine that shows that someone made a RDP connection or so? If this is possiblem then can I also see which user and what IP address was used to establish the connection or so? Thank you
If you check in the security log then there should be an entry via the Event Viewer if auditing of logon events is enabled which is kept at default. After that search for type 10 logon events. But I dont think that you will be able to see the IP Address but instead of that you will only see the name of the computer. You can also get some help from the Firewall logs that track down the IP of the computer incase you match the logs to the time of the type 10 logon event.
You can try to use the Port Reporter Parser tool which is a log parser for Port Reporter log files. This tool is now available for download. Port Reporter Parser has many features that can help you analyze Port Reporter log files. You can download the Port Reporter Parser tool from the following link:
http://download.microsoft.com/downlo...f/PRParser.exe