Alert when Admin logs in over a TS session

Rating: No reviews yet
Downloads: 270
Released: Oct 17, 2008
Updated: Oct 18, 2008 by Bitzie
Dev status: -not yet defined by owner-

Recommended Download

Source Code TSLoginAlert.xml
source code, 1K, uploaded Oct 18, 2008 - 270 downloads

Release Notes

Just for fun I built an alert for when an Adminstrator logs into the server over a Terminal Server session.

<?xml version="1.0" encoding="utf-8" ?>
<AlertDefinitions>
<AlertDefinition ID="1912db74-54bd-44da-996f-5623e022270f" Default="1"
Title="Admin logging onto server in TS session" Source="Server">
<Parameters>
<Path>Security</Path>
<Provider>Microsoft-Windows-Security-Auditing</Provider>
<SetEventID>4778</SetEventID>
</Parameters>
</AlertDefinition>
</AlertDefinitions>

Add it into your console like the other alerts, when someone logs into the TS console on the server you will get an alert like this:

An alert was detected on your network. Further investigation into the issue is recommended.

Computer: SERVER
Date/Time generated: 10/17/2008 8:02:55 PM
Title: Admin logging onto server in TS session
Source: Server
Description:
A session was reconnected to a Window Station.

Subject:
Account Name: SBSadmin
Account Domain: SMALLBIZCO
Logon ID: 0xb869d

Session:
Session Name: RDP-Tcp#0

Additional Information:
Client Name: Workstationname
Client Address: IPaddresshere

This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.

Reviews for this release

No reviews yet for this release.