Is there a record kept of remote access in Windows 7 Pro?

Question

I specifically asked someone not to remotely access a computer running Win 7 Pro 32bit.

Now I see on the computer that Remote Access is fully set up to their laptop.

Is there a log or record somewhere in Win 7 of the times, dates and/or files they have remotely accessed via their laptop? I would like some proof before I confront them.

Solution 1

I found this very helpful page about Windows 7 event log

As well as events 4624 (logon) and 4634 (logoff), I believe 4778 (session connect) and 4779 (session disconnect) are useful for monitoring remote desktop sessions.

Solution 2

It's not really a log file and I only had a WinXP system to verify it, but I assume the behavior hasn't changed that much: The remote desktop application (mstsc.exe) on the local machine remembers the hostname/ip address of the last few remote hosts that one connected to.
Just start it and then you should be able to see entries in the drop down list.

Using this data, there is no way to tell when the login happened and it can therefore only give an indication.

Solution 3

In Event Manager in Windows 7 all the logs regarding attempted RDP connections made from the machine are under Windows Logs > Application and Service Logs > Microsoft > Windows > TerminalServices-ClientActiveXCore > Microsoft-Windows-TerminalServices-RDPClient/Operational

Will show you addresses attempted and what happened with the connection

Solution 4

The short answer, not by default.

However if the firewall is on and logging on the firewall is enabled on the host machine, you can see logon attempts from remote machines in the Event Viewer under the Security Log. They normally have an Event ID of 10 and shows the machine name that connected at the time.

View more solutions

Comments

[David W. Fenton]

The firewall does NOT have to be turned on to enable logging via the security log and event viewer -- you just have to edit the policies to turn on logging of remote access.

[BinaryMisfit]

@David Interesting. We were never able to get it to work without the firewall.

[David W. Fenton]

Are you going to Control Panel | Administrative Tools | Local Security Policies | Local Policies | Audit Policy?

[BinaryMisfit]

@David. Yes. We spent about a week trying different things. Even Microsoft couldn't get it working.

[David W. Fenton]

Is this in a domain environment?

[user 99572 is fine]

Could you provide a step-by-step or a screenshot? This would be a lot more helpful.

[benjaminz]

Hi, the link you posted is no longer valid, could you update the link? Thanks!