Share via

How to monitor application usage shared via terminal server with the help of windows logs

Anvar 1 Reputation point
2020-08-27T15:09:09.697+00:00

I need to know the following information using Windows logs

  1. Application opened by a user
  2. Application closed by a user
  3. Access given for a user for an application
Windows for business Windows Client for IT Pros User experience Remote desktop services and terminal services

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-08-28T05:31:05.967+00:00

    Hello @Anvar ,

    1&2. Application opened/closed by a user

    The RDP related Event Logs from terminal server describe the main stages of a connection: Network, Authentication, Session Log on/ Log off, and Session Disconnect/Reconnect, so from the server side, we can’t find any Remoteapp usage related Logs.

    The following link covers the same topic ( how to track the access to the RemoteApps).
    https://social.technet.microsoft.com/Forums/en-US/c2bed8e6-43fc-466f-97cf-9fad6ca6fcab/configure-remoteapp-event-logging?forum=winserverTS

    Based on my research, I found you can display the list of the running processes in the specific RDP session using this command:

    qprocess /id:number

    3.Access given for a user for an application

    In Collection, edit the Remoteapp properties , and in User Assignment, we can find the access of an app given to specific users.

    21029-image.png

    Windows RDP-Related Event Logs:
    https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

    Hope my answer helps you!

    Best Regards,
    Karlie

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.