{"id":201,"date":"2014-07-22T13:10:42","date_gmt":"2014-07-22T18:10:42","guid":{"rendered":"https:\/\/sysadminnightmare.com\/?p=201"},"modified":"2014-07-22T13:10:42","modified_gmt":"2014-07-22T18:10:42","slug":"server-logins","status":"publish","type":"post","link":"https:\/\/sysadminnightmare.com\/index.php\/2014\/07\/22\/server-logins\/","title":{"rendered":"Server Logins"},"content":{"rendered":"<p>Real quick post on a tech tip type of incident I ran into today.<\/p>\n<p>On a server I needed to simply see who has logged into it. I am sure there are several hundred of ways to complete this, but my technique was to check out the security event log. <\/p>\n<p>While looking at the event log I did find the Event ID 4624 which shows logon events. Great .. I will just filter these and see who was been on it. <\/p>\n<p>The problem I found is that this also shows all the agents or other events where accounts &#8220;logon&#8221; to the system. So it wasn&#8217;t a small list, nor just what I wanted. So turning to a Custom View I filtered with the following XML which showed me those Events, but also filtered by Logon Type to be 10, which is Remote Desktop Logins.<\/p>\n<p>Exactly what I needed. So here: <\/p>\n<p>[code language=&#8221;css&#8221;]<br \/>\n<QueryList><br \/>\n  <Query Id=\"0\" Path=\"Security\"><br \/>\n    <Select Path=\"Security\"><br \/>\n       *[EventData[Data[@Name=&#8217;LogonType&#8217;] and (Data=&#8217;10&#8217;)]]<br \/>\n        and<br \/>\n       *[System[(EventID=&#8217;4624&#8242;)]]<br \/>\n    <\/Select><br \/>\n  <\/Query><br \/>\n<\/QueryList><br \/>\n[\/code]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Real quick post on a tech tip type of incident I ran into today. On a server I needed to simply see who has logged into it. I am sure there are several hundred of ways to complete this, but my technique was to check out the security event log&#8230;. <a class=\"continue-reading-link\" href=\"https:\/\/sysadminnightmare.com\/index.php\/2014\/07\/22\/server-logins\/\"> Continue reading <span class=\"meta-nav\">&rarr; <\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[2,8],"tags":[],"class_list":["post-201","post","type-post","status-publish","format-standard","hentry","category-admin","category-tech-tips-101"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2bgeE-3f","_links":{"self":[{"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/posts\/201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/comments?post=201"}],"version-history":[{"count":0,"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/posts\/201\/revisions"}],"wp:attachment":[{"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/media?parent=201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/categories?post=201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sysadminnightmare.com\/index.php\/wp-json\/wp\/v2\/tags?post=201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}