|
Posted by RedFoxy on March 24, 2008, 10:48 am
If you were Registered and logged in, you could reply and use other advanced thread options
Hi all!
I need to know if a windows 2003 SBS (the full version with SQL not the
standard version) logs Terminal server connections and where are the
logs, i need to know the ip address of a connection by terminal server
and if is possible, what they do like data transfer and similar, I'm
reading the event log of windows, but i don't foun anything of strange,
i found only some try of a terminal server connection that try to
connect some printers that server don't know and it haven't the right
drivers...
The windows 2003 server SBS is just installed, i haven't changed any
policy about log on and terminal server and windows have all windows
updated.
Thank's for all!
|
|
Posted by S. Pidgorny on March 25, 2008, 4:14 am
If you were Registered and logged in, you could reply and use other advanced thread options
Terminal Server logons can be found in the security log, logon type 10
(XP/W2K3 and up). This, and the rest, is subject to correct audit policy.
--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-
* http://sl.mvps.org * http://msmvps.com/blogs/sp *
> Hi all!
> I need to know if a windows 2003 SBS (the full version with SQL not the
> standard version) logs Terminal server connections and where are the logs,
> i need to know the ip address of a connection by terminal server and if is
> possible, what they do like data transfer and similar, I'm reading the
> event log of windows, but i don't foun anything of strange, i found only
> some try of a terminal server connection that try to connect some printers
> that server don't know and it haven't the right drivers...
> The windows 2003 server SBS is just installed, i haven't changed any
> policy about log on and terminal server and windows have all windows
> updated.
>
> Thank's for all!
|
|
Posted by RedFoxy on March 25, 2008, 5:10 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Terminal Server logons can be found in the security log, logon type 10
> (XP/W2K3 and up). This, and the rest, is subject to correct audit policy.
>
I've not changed anything about policy, the server is just installed,
and when i look at security event log i haven't logon type, i've only
type and another field called user
|
|
Posted by S. Pidgorny on March 25, 2008, 6:11 am
If you were Registered and logged in, you could reply and use other advanced thread options
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 25/03/2008
Time: 9:08:25 PM
User: GETAWAY\Administrator
Computer: GETAWAY
Description:
Successful Logon:
User Name: Administrator
Domain: GETAWAY
Logon ID: (0x0,0x81B3160)
Logon Type: 10
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: GETAWAY
Logon GUID: -
Caller User Name: GETAWAY$
Caller Domain: WORKGROUP
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3880
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 4339
Note the logon type.
--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-
* http://sl.mvps.org * http://msmvps.com/blogs/sp *
> S. Pidgorny <MVP> ha scritto:
>> Terminal Server logons can be found in the security log, logon type 10
>> (XP/W2K3 and up). This, and the rest, is subject to correct audit policy.
>>
>
> I've not changed anything about policy, the server is just installed, and
> when i look at security event log i haven't logon type, i've only type and
> another field called user
|
|
Posted by RedFoxy on March 25, 2008, 6:18 am
If you were Registered and logged in, you could reply and use other advanced thread options
> Here's an example of a logon event:
>
> Event Type: Success Audit
How can I see if i've the audit actived?
|
| Similar Threads | Posted | | Terminal Server on the DMZ | December 26, 2005, 12:59 am |
| Terminal Server Security | December 6, 2006, 5:10 pm |
| Group Policy with Terminal Server | July 23, 2005, 5:24 am |
| secure lockdown of terminal server liscencing? | July 5, 2007, 6:58 pm |
| Terminal server security issue with screen cache? | December 19, 2005, 12:20 pm |
| Using SSL Certificate for TSAC on NLB Windows 2003 Terminal Server | March 28, 2006, 11:42 am |
| Terminal Server with Roaming Profile Locks Accounts | January 3, 2007, 1:29 pm |
| Terminal server rdp, tls certificates & subject alternative names? | June 30, 2008, 11:03 am |
| Security settings on the Terminal Server prevent automatic logon | September 12, 2005, 3:18 am |
| Terminal Services | December 1, 2005, 4:26 pm |
|
XML site map