[RESOLVED] Terminal Services - Can I use it like Big Brother?

[MMock]

We have a server that's onsite in my office that a remote user has access to. My boss wants to know if this user has been on the server recently. The user would have gotten on through terminal services. Are connects or logins logged? If so, how do I look at this info, and if not, is there another way to find out who's been connecting and using the server?

Thanks.

[MMock]

I see in the Windows system security log that an entry is logged, but this log is so full, can I narrow it down?

[si_the_geek]

If you mean in Event Viewer, you can do one or more of the following:

• click on the User column to sort it, then scroll to the find the user you are interested in (rather than scroll, you can use the next option).
• right-click on "Security" and select "View"->"Find" to search by user (and/or whatever else you like).
• right-click on "Security" and select "Save Log File as.." to export to a text file, which you can use Notepad to open/search.

[MMock]

Yes fortunately the user I was interested in only had three entries in the five-days worth of entries listed so it was easy to narrow down. Thanks!