Tracking Terminal Services login

[Fujimitsu]

I'm looking for an easy way to track when users log-in and log-out of terminal services.

We have a win2003 server that is setup to launch an app when a user logs into terminal services. When they close the app, they're automatically logged off. I need a way to track what time users log in and out, so that I can see who is making some changes late at night.

In the event log, there is an event for each time that a user logs in, but nothing for log outs.

I really don't care how "ghetto" of a solution it is, as long as I have some way of knowing.

Anyone got any ideas? I was thinking about just using a script or small logging app that launches when they log in, but what would I do about logouts?

[itznfb]

just use an audit policy on logoff to throw an event to the event viewer

[yankee]

You could also add something to their login script that would add a line with a datestamp to the .txt of your choosing. That's just off the top of my head, I'm sure something similar could be done for logoffs too.

itznfb's suggestion is the best, though. that's really what audit policies are for.

[Fujimitsu]

Thanks guys.

I had only taken a quick glance at the audit policy, I saw that it was enabled for "audit account logon events"and then just moved on. I was looking for "audit logon events". What's the difference? just curious.

Also, any suggestions on how to assemble just this information in an easy to read way? I've always just dug through the logs by hand, but they're asking for something a bit cleaner... a parsing app or something similar.

[itznfb]

i believe the "Audit Account Logon Events" will record logon/logoff event details, where "Audit Logon Events" records success/failure of logon events.

all our servers here at work use GPOs and don't have any of these options so i can't look, let me see if i can find more online.