You'd have to make some pretty serious customizations to the templates with 'Forward' in the name from this folder: /sbin/e-smith/audittools/templates
When done you'd have log files that grow pretty quickly.
I wanted to do the same thing a few years ago; I started with a powershell script that shows RDP logins -- but that script won't show the remote IP addresses.
I couldn't get an easy, succinct report from my firewall (Smoothwall, not SME) showing RDP IP connections, so we ended up writing a custom program that doesn't actually work that well.
In case it's helpful to you, here are the powershell script and batch file we used for a while that shows *who* has connected - locally or remotely - in the last 14 days. Login event type 7 (RDP Login) does include an IP address, so you may be able to modify this script to show the remote IP address used.
# Connects to the security eventlog of a remote computer and retrieves successful login events ( event ID 528 ) and what type of login took place
# Information about login types found at http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=528
#
# 22.09.2009 Konrß≡ Hall
$wkstn = $args[0]
$after = [DateTime]::Now.AddDays(-14)
$events = Get-EventLog -ComputerName $wkstn -LogName "Security" -after $after | Where {($_.eventid -eq 528) }
if ($events) {
foreach ( $event in $events ) {
if (($wkstn -eq "acctg") -and ($event.message | Select-String "Logon Type: 2")) {
$wkstn+ " TS " + $event.UserName +" "+ $event.TimeGenerated.DateTime+" "+ $after
}
if (($wkstn -ne "acctg") -and ($event.message | Select-String "Logon Type: 2")){
$wkstn+ " Kbd "+$event.UserName + " "+ $event.TimeGenerated.DateTime+" "+ $after
}
if (($event.message | Select-String "Logon Type: 7")){
$wkstn + " Unlock "+ $event.UserName +" "+ $event.TimeGenerated.DateTime+" "+ $after
}
if (($event.message | Select-String "Logon Type: 10")){
$wkstn + " RDP "+$event.UserName +" "+ $event.TimeGenerated.DateTime+" "+ $after
}
if (($event.message | Select-String "Logon Type: 11")){
$wkstn+ " Cached "+$event.UserName +" "+ $event.TimeGenerated.DateTime+" "+ $after
}
}
}
else {$wkstn+ " No Logins"+" " +" " +" "+ $after}
I use this batch file to call the above powershell script for a range of workstation names:
@echo off
set logfile=%~dp0Logins_%date:~10,4%%date:~4,2%%date:~7,2%.xls
echo Computer Type Username Time Since> %logfile%
for %%w in (acctg backup01 webdev vm001 vm002 vm003 sql2005) do (
set wkstn=%%w
call :getlogins
)
goto :done
:getlogins
echo %wkstn%
ping -n 1 -w 2 %wkstn% >nul 2>nul
if "%errorlevel%" == "0" (
powershell %~dp0userlogins.ps1 %wkstn% |find "%wkstn%" >> %logfile%
goto :eof
)
echo %wkstn% No PING >> %logfile%
goto :eof
:done
6 Replies
1412 Views