Any ideas on how to detect during login if the person is using Remote Desktop or locally logging in to the system?
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Answers

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.
0
Nevermind, I found a way.

The system variable %sessionname% will return Console if its local or RDP* if its remote.
Answered 10/30/2006 by: cessna
Senior Yellow Belt

Please log in to comment
1
ORIGINAL: cessna

Any ideas on how to detect during login if the person is using Remote Desktop or locally logging in to the system?


If security auditing is enabled on the machine, a login event will get written to the Security event log. The Event ID for an RDP successful login seems to be 682.

WMI will read event logs. Take a look at this article at Microsoft for some nice code to embed in a WSH script if you like. You'd want to modify it to look for type "success" and event ID 682. For example, ("Select * FROM Win32_NTLogEvent WHERE Logfile = 'Security' AND EventType = 4 AND EventCode = 682") Here's the article:
http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct04/hey1026.mspx

Hope this helps.

William

PS - Just saw your "never mind" reply, you must have written it as I was writing this one. Oh well....
Answered 10/30/2006 by: williamp
Orange Belt

Please log in to comment
0
Cool, another way to attack the problem though.

Thanks for the tip!
Answered 11/06/2006 by: cessna
Senior Yellow Belt

Please log in to comment
Answer this question or Comment on this question for clarity