On a monitor user login change monitoring, such as it's written by monitoring the security log to monitor, but xp system security log log events (ID528) is not to record at the login IP port information (such as remote desktop login), but after 2003 systems have, so in the xp system is there any way to get these information

CodePudding user response:

In the operation interface, use IPCONFIG/ALL can't see

CodePudding user response:

I looked at it and there is a IP, event type is 682, the session will redirect events recorded (not login successful),
In addition, you can in the group policy - & gt; The user Settings - & gt; Add in the login script script, the effect is: after the user login, automatically run the script,

 @ echo off 
The echo time date % % % % & gt;> C: \ 3389\3389. The log 
Netstat ano | find "3389" | "listen" find/I/v & gt;> C: \ 3389\3389. The log 
The echo.> C: \ 3389\3389. The log