Windows XP forum: Remote Desktop logs

There should be an entry made into the event viewer logs when someone uses Remote Desktop. It likely won't be more detailed than a time and date when they connected, and then another when they disconnected, but from the sound of things, that's all the more you need.

You could probably construct a Perl program or some such that would locate just the Remote Desktop entries and provide you with a handy little report. For someone who knows Perl pretty well, it probably wouldn't be more than a dozen or so lines of code.

I don't think that will work if the user just locks their PC instead of logging off.

I can't find where I need to go to track these entries.

I am going to Computer Management and I am looking under Event Viewer under Application Logs. Do I need to create a new Alert to log this information in Event Viewer?

I found what I was looking for

You can track logging successes and failures by setting up an audit policy using Local Computer Policy. From the Group Policy Editor (gpedit.msc), drill down to Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policy | Audit logon events. Be cautious logging successes, as this will make the event log very full.

I'm surprised no one has used this before.