Windows Server 2008 R2 – Are There Any RDP Activity Logs?

I have recently started using Remote Desktop Connection Manager, and once if its features is that you can right click on a server and list the sessions it has open.

This will tell you the session status, the username and also where they are logged in from - giving you a clue as to who you can ask to disconnect

The list sessions feature works on Server 2003, as well as 2008 R2. I don't have any 2008 boxes to test against, but I assume it will work without issue there too.

The last command will show user logins, logouts, system reboots and run level changes.

The lastlog command "reports the most recent login of all users".

The file /etc/syslog.conf will show how your log files are configured. For example, it may show that auth and authpriv.* facilities are logged to /var/log/auth.log. In other cases, such as Ubuntu, look at /etc/rsyslog.conf and the files in /etc/rsyslog.d for this information.

Your log files will probably be rotated, so in addition to looking at files such as /var/log/auth.log, you may need to look in their older counterparts such as /var/log/auth.log.1 and /var/log/auth.log.n.gz (using zcat) where "n" could be any integer depending on how your rotation is set up.

Although the files can be manipulated by the users, sometimes you can look at ones such as ~username/.bash_history. Even files like ~username/.lesshst can have useful information if you really need to dig deep.