Batch File Finds Out Who RDPed the Server

Administrators and privileged users often use RDP client software such as Remote Desktop to access a server to perform tasks and troubleshoot problems. When doing so, it's difficult to pinpoint the last actions that were applied to the server. However, if you know which administrators and privileged users recently logged on to that server, you can contact them to find out this information. I've come up with a batch file—RDPLogon.bat—that lets you quickly identify those people.

Here's what you need to do:

Listing 1: RDPLogon.bat

@Echo off

Echo %date% %time% %username% >> c:RDPRDPlog.txt
Netstat -n -p tcp | Find ":3389" >> c:RDPRDPlog.txt
Echo==================================================================  >> c:RDPRDPlog.txt

RDPLogon.bat captures information about each person who logs on to the server and appends that information to an output file named RDPlog.txt, which resides in C:RDP. By looking at the RDPlog.txt file, you can identify the administrators and privileged users who logged on recently and which machines they used for that logon.

Figure 1 shows sample output from RDPLogon.bat.

This output contains information about three logons. (For easier reading, the batch file puts a dashed line after each logon entry.) The first line in each entry shows when the logon occurred (date and time) and by whom (user's domain ID).

You can find out where each logon occurred by looking at the second line in each entry. The information in this line is obtained using the Netstat command. The second string of numbers, which I highlighted in yellow in Figure 1, shows the IP address and RDP port number of the remote machine used for the logon. (The first string of numbers is the server's IP address and RDP port number.) If an entry is missing the Netstat results, like the last entry in Figure 1, it means that the logon was done from the physical server console.

RDPLogon.bat is a simple tool that you can use to quickly identify the administrators and privileged users who recently logged on to a server. Armed with this knowledge, you can contact them to find out the last actions they performed on the server. This is much faster than looking through and trying to decipher huge event logs to find the last actions. Note that this tool is meant for environments in which administrators and privileged users are cooperative, since they could conceivably delete their logon entries if they know the RDPlog.txt file exists and want to hide their actions.