RDS Login and Logout Logging Script
<# .SYNOPSIS RDS Login and Logout Logging Script .DESCRIPTION This script automatically logs user login and logout events for Remote Desktop Services. It runs continuously as a background job, monitoring the Windows Event Log for relevant events. .NOTES File Name : RDSLoginLogoutLogger.ps1 Author : [Your Name] Prerequisite : PowerShell V3 or later, admin rights on the RDS server Version : 1.0 Date : [Current Date] .EXAMPLE Start-Job -FilePath .\RDSLoginLogoutLogger.ps1 #> # Configuration $logFilePath = "C:\Logs\RDSLoginLogout.log" $lastRunFile = "C:\Logs\RDSLoginLogoutLastRun.txt" # Ensure log directory exists $logDir = Split-Path $logFilePath -Parent if (-not (Test-Path $logDir)) { New-Item -ItemType Directory -Path $logDir | Out-Null } # Function to write log entries function Write-Log { param ( [string]$Message ) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" $logEntry = "$timestamp - $Message" Add-Content -Path $logFilePath -Value $logEntry } # Function to get the last run time function Get-LastRunTime { if (Test-Path $lastRunFile) { return Get-Content $lastRunFile } return (Get-Date).AddDays(-1).ToString("o") # Default to 1 day ago if no last run time } # Function to save the last run time function Save-LastRunTime { param ( [DateTime]$LastRunTime ) $LastRunTime.ToString("o") | Set-Content $lastRunFile } # Main logging loop try { Write-Log "RDS Login/Logout logging started." while ($true) { $lastRunTime = Get-LastRunTime $currentTime = Get-Date # Query for login events $loginEvents = Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' ID = 21 # Event ID for session logon StartTime = $lastRunTime } -ErrorAction SilentlyContinue # Query for logout events $logoutEvents = Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' ID = 23 # Event ID for session logoff StartTime = $lastRunTime } -ErrorAction SilentlyContinue # Process login events foreach ($event in $loginEvents) { $username = $event.Properties[0].Value $sessionId = $event.Properties[1].Value Write-Log "User logged in: $username (Session ID: $sessionId)" } # Process logout events foreach ($event in $logoutEvents) { $username = $event.Properties[0].Value $sessionId = $event.Properties[1].Value Write-Log "User logged out: $username (Session ID: $sessionId)" } # Save the current time as the last run time Save-LastRunTime $currentTime # Wait for a minute before the next check Start-Sleep -Seconds 60 } } catch { Write-Log "An error occurred: $_" } finally { Write-Log "RDS Login/Logout logging stopped." }
To use this script:
- Save the script as
RDSLoginLogoutLogger.ps1in a suitable location on your RDS server. - Modify the
$logFilePathand$lastRunFilevariables at the beginning of the script if you want to change the default log locations. - To run the script as a background job, open PowerShell as an administrator and use the following command:
Start-Job -FilePath C:\Path\To\RDSLoginLogoutLogger.ps1
ReplaceC:\Path\To\with the actual path where you saved the script. - To check the status of the job:
Get-Job - To stop the job when needed:
Stop-Job -Id <JobId> - Replace
<JobId>with the ID of the job from theGet-Jobcommand.
Key features of this script:
- Continuous Monitoring: Runs as a background job, continuously checking for new login and logout events.
- Efficient Event Querying: Uses the last run time to query only for new events since the last check.
- Separate Log File: Logs events to a dedicated file for easy review and analysis.
- Error Handling: Includes basic error handling to log any issues that occur during execution.
- Low Resource Usage: Checks for new events every minute, balancing timeliness with system resource usage.
Notes:
- This script needs to be run with administrator privileges on the RDS server.
- The script creates a log file and a last run time file. Ensure the specified paths are accessible and writable.
- For long-term use, consider implementing a log rotation mechanism to manage log file sizes.
- You may need to adjust the event IDs (21 for login, 23 for logout) if your RDS environment uses different event IDs for these actions.
- Always test the script in a non-production environment before deploying it to production servers.
This script provides a robust solution for automatically logging RDS login and logout events, which can be valuable for security auditing, user activity tracking, and compliance purposes.