I work all day on a Windows Server 2003 machine and have noticed people "borrowing" my machine by using Remote Desktop to log in. This is pretty much "normal behaviour" at the company I work at, but I'd like to know when this is happening.
Is there any way I can be alerted each time someone remote desktop's onto my server? A simple "Bob has logged in" would be great – and I imagine there is a facility somewhere to enable this.
Best Answer
There are some good suggestions here - but I've taken the hard work out of it all by writing a remote access monitor tool. I've open sourced it in case anyone wants to use it / add to it.
http://remoteaccessmonitor.codeplex.com/
It examines the process list and alerts when a process is started by "another user" - so it works for all remote access types.