#Server user activity audit portable

You can find IP Addresses, but then it's hard to tell if they are related to all the unsuccessful login attempts. The final best practice for server auditing is to use a good monitoring tool, since these audits collect too much information for administrators to sort through on their own. The problem with the event logs mentioned by Andy above is that they are not very clear or descriptive as to who's doing what. I have not tested it as it's basically a vbscript that I would need to dissect before using. There is also ts_block which allows you to automatically block IPs that are brute forcing your server's RDP (which I'm guessing would have some log of RDP attempts):Īs you can see in that link, the author is a serverfault user. It's 'hands on,' but a no-brainer as well and beats deciphering the event logs.

#Server user activity audit portable

I haven't tested it extensively, but downloaded and scanned it (the portable version) and although the UI is a bit on the ugly side, it's working on a 2012 R2 server without issue thus far. I've been through most of the free/affordable answers on this page as well as searching elsewhere (for days, including reading the Event logs mentioned by Andy Bichler) and here's an alternate free RDP monitoring and blocking tool: Navigate Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Logon/Logoff.You'll also need to ensure these logs are created to do that: Information on the related EventIds we're filtering on can be found here:įor RDP connections you're specifically interested in LogType 10 RemoteInteractive here I've not filtered in case the other types are of use but it's trivial to add another filter if required. Here's a solution in PowerShell: Get-EventLog -LogName Security | ? Introduction to Auditing Privileged users can create policies that track the changes that all users, including other privileged users, make in the database.