Please Read: Significant Update Planned, Migrating Forum Software This Month

See more
See less

auditing ts sessions

  • Filter
  • Time
  • Show
Clear All
new posts

  • auditing ts sessions

    Hi all, this is my first post here.

    I work for a US-based fortune 500 company and we've recently been asked by an external auditors to prove that we are auditing all remote access sessions by external vendors and employees.

    We've recently deployed 7 Win2008 TS servers with TS RemoteApp, and we're getting approx. 10-15 concurrent sessions per server.

    I wondered, what method are you using for your auditing purposes?



  • #2
    Re: auditing ts sessions

    You will use some third party tool, like Quest Change Audit, SIM/SOC software etc.

    You can enable logging from the GPO, but this dont provide central tracking...
    Best Regards,

    Yuval Sinay

    LinkedIn:, Blog:


    • #3
      Re: auditing ts sessions

      Hi Yuval.

      Perhaps I wasn't clear enough. I would like to see what the users did when they were connected to the terminals. Textual logging isn't enough for us, we need visual logging.

      Anyway, it's late for me, I will look at the thread tomorrow.



      • #4
        Re: auditing ts sessions

        Hi Tapu,

        You might want to take a look at ObserveIT, which is a software that allows monitoring and auditing of human actions done on servers and workstations. It will monitor any time of remote connections - TS/RDP, Citrix and even VNC or Damware/NetOP and more. Once installed, ObserveIT indexes all the screenshots and adds metadata containing information about each separate screenshot. This allows for easy textual searches through the database. It will store all the recordings and metadata in a central SQL database, and will allow for easy to use and role-based management console. This way you can assign view-only roles to your auditors or security managers and let them view the recordings they need to see.

        Please see this article:

        Integrating ObserveIT with the New Windows Server 2008 Terminal Server Features:

        If you are interested in learning more, or even of getting a demo set up for you, please contact me and I'll set you up.

        Daniel Petri
        Microsoft Most Valuable Professional - Active Directory Directory Services


        • #5
          Re: auditing ts sessions

          Thank you Daniel, I've looked into ObserveIT and it indeed seems impressive.