Detect Remote Desktop Login?
Any ideas on how to detect during login if the person is using Remote Desktop or locally logging in to the system?
0 Comments
[ + ] Show comments
Answers (3)
Please log in to answer
Posted by:
williamp
17 years ago
ORIGINAL: cessna
Any ideas on how to detect during login if the person is using Remote Desktop or locally logging in to the system?
If security auditing is enabled on the machine, a login event will get written to the Security event log. The Event ID for an RDP successful login seems to be 682.
WMI will read event logs. Take a look at this article at Microsoft for some nice code to embed in a WSH script if you like. You'd want to modify it to look for type "success" and event ID 682. For example,
("Select * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventType = 4 AND EventCode = 682") Here's the article: http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct04/hey1026.mspx
Hope this helps.
William
PS - Just saw your "never mind" reply, you must have written it as I was writing this one. Oh well....
Posted by:
cessna
17 years ago
Nevermind, I found a way.
The system variable %sessionname% will return Console if its local or RDP* if its remote.
The system variable %sessionname% will return Console if its local or RDP* if its remote.
Rating comments in this legacy AppDeploy message board thread won't reorder them,so that the conversation will remain readable.