3

Is there a tool for Windows Server 2008 that can alert me when a connection is made over Remote Desktop?

I would like the alert via SMS, but email would also be fine.

It seems like this tool must exist somewhere already, can anyone point me to something like this?

Optionally, perhaps it could just watch for specific events in the event log?

Edit:

A free and simple solution would be best.

Community
  • 1
Geoffrey Chetwood
  • 216
  • 5
  • 13

2 Answers2

7

I think monitoring the event log is the easiest scenario. You can pick your poison (Microsoft System Center Essentials, Nagios, etc.) and have it send out an SMS alert when you come across Event 528's and 540's of logon type 10. Monitor 538's (again of type 10) in order to see them log off.

Reference: http://www.windowsecurity.com/articles/Logon-Types.html

Keep in mind that almost all major carriers have SMTP gateways that allow you to send SMS messages using an e-mail address. For instance if your number is 123-456-7890 and you're with AT&T, you can receive SMS messages at 1234567890@txt.att.net. That way, your event monitoring solution doesn't explicitly have to have SMS capability. Do be aware that it's not perfect and can add quite a delay in some cases. It's just a quick and dirty solution.

http://www.notepage.net/smtp.htm

pk.
  • 6,413
  • 1
  • 41
  • 63
  • You can also do this by simply adding a task to the event- you don't need any special software to send an email – Jim B Jul 23 '09 at 00:22
  • @Jim B: Add that as an answer, with a few example steps of how to do it. You are sure to get some nice rep for it. – Geoffrey Chetwood Jul 23 '09 at 12:49
  • @Jim B: I think he wouldn't be able to specify the logon type 10 with the built-in task scheduler in Windows Server 2008. He's limited to the Event Id. – pk. Jul 23 '09 at 14:41
1

I think you could probably configure Nagios for what you want to do. It can search logs for events and send pages (sms).

Keith
  • 352
  • 3
  • 11