Hi, Is remote desktop connections are being logged? Can I see whom had connected and their ip address. I can see wrong user/pass connection tries from event viewer but couldn't find ant log file for successful connections. Thanks.

You can audit login events and filter for event 528 type 10. Use GPO to change audit for login events. Now as for the IP. That depends on if it is a local machine under the AD control or not. Otherwise there are many other ways to track the IP. You wouldn't want to allow too many people Remote Desktop access. Further you would want to limit their log on times and disk quota's. I would use strong passwords and change them often.

Thanks for your reply. Actually We aren't use AD and using TS for only admin purposes. (Just enabled from my computer/properties) On the other hand, same machine is also is a web server. So that when I enable the audit, tons of events will occur and it is very hard to manage them. (Cause all of the web request will also be logged in via IIS Auth) I guess it will be more easy if, ts will generate a log file, like IIS do. I guess auditing is the only way to see whom logged in. The machine is not in AD. And sometimes, admins needs to login in different places. (Home, office, holiday). Will windows itself wont log their ip addresses? Thanks.