Gravar Log Acesso WTS

fonte:
First enable auditing in secpol.msc.
I found this is needed because the other events triggered too early to get the hostname.

• Click Start and type secpol.msc then hit enter.
  the Local Security Policy window will be displayed
• now navigate to Local Policy > Audit Policy
  and right click the Audit account logon events policy option and choose Properties.
• Now check the Success box (failed attempts will not be logged this way)
• Exit from secpol.msc

Now create a VBScript-file (for example called c:\temp\log.vbs):
(also edit the location of the desired logfile, here c:\temp\rdp.log)

Function sessionNumber
 Dim oShell, oExec, sOutput, iUserPos, iUserLen, iStatePos
 Set oShell = CreateObject("WScript.Shell")
 Set oExec = oShell.Exec("query session %username%")
 sOutput = LCase(oExec.StdOut.ReadAll)
 iUserPos = InStr(sOutput,LCase(oShell.ExpandEnvironmentStrings

("%username%")))
 iStatePos = InStr(sOutput,"active")
 iUserLen = Len(oShell.ExpandEnvironmentStrings("%username%"))
 sessionNumber = CInt(Trim(Mid(sOutput,iUserPos+

iUserLen,iStatePos-iUserPos-iUserLen)))
End Function

Function clientName
 Dim oShell
 Set oShell = CreateObject("WScript.Shell")
 On Error Resume Next
 clientName = LCase(oShell.RegRead("HKCU\Volatile Environment\"

&sessionNumber&"\CLIENTNAME"))
 If Err.Number<>0 Then
 clientName =  "unknown"
 End If
End Function

outFile="c:\temp\rdp.log"

Const ForAppending = 8

Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objFile=objFSO.OpenTextFile(outFile,ForAppending,True)
objFile.Write now() & " ; " & clientName & vbCrLf
objFile.Close

Now for the last part create a scheduled task for starting this script.

• Click Start and type taskschd.msc then hit enter.
• Choose Create Task in the right pane
• Name it Logon RDP or something
• In the Trigger-tab choose New and choose "Begin the task" On an event
• In "Log" choose Security and in "Event ID" type 4624
• Hit Ok
• In the Action-tab choose New and choose "Start a program"
• In Program type cscript.exe and in Add argument type c:\temp\log.vbs
• Hit Ok twice

Now when someone logs in via RDP, their hostname is logged in c:\temp\rdp.log
Note that also local logins will be logged (i haven't tested that yet because i'm on a remote :)
but i guess that's not a problem.
You could of course adapt the log.vbs to include username, remote ip... etc.
(pfew, Windows XP was a lot easier. That one just logs the hostname in the event)
Maybe someone can come up with an easier solution :)

---

1334781    

Edit #2
This is from a completely clean Windows 7 install.
(Main machine is Test-pc and machine with which i logged on is XPS8500):

Apagar arquivos antigos de uma determinada pasta com + 15 dias

' Apagar arquivos antigos de uma determinada pasta

'//////////////////////////////INICIO////////////////////////////////////////////
'Script para executar o purger e limpar arquivos em locais especificos
'Autor: Cristiano – – cristiano.crishpg@gmail.com
' Versão 1.3
'Data 30/10/2013
'Você vai precisar de fazer o download do purger (ftp://ftp.sac.sk/pub/sac/utilfile/purger.zip )
'Copie o purger para uma pasta, sysvol ou netlogon, ou para uma pasta compartilhada da rede
'Existe uma copia do purger no meu email do Gmail
'Insira o caminho onde está o purger, usando caminho UNC
strPath = "C:\temp\"

'Criação do objetos
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objNetwork = CreateObject("WScript.Network")
Set WshShell = WScript.CreateObject("WScript.Shell")
'set objEnvironment = WshShell.Environment("user")
'strTMPVar = objEnvironment("ANEXO SENIOR")

strUserName = objNetwork.UserName
'strComputerName = objNetwork.ComputerName

strComputer = "."
'wscript.echo strTMPVar

'Deleta arquivos na pasta temp do peril do usuário
'Está configurado para apagar arquivos na pasta temp do usuário do windows Vista, caso seja outra pasta altere o caminho.
'A variavel strUserName faz referencia ao nome de usuário da rede.
'subDelFiles ("C:\Users\"& strUserName &"\Configurações locais\Temp")
subDelFiles ("C:\temp\ANEXO SENIOR\")
'sub procedure executa a limpeza das pasta temp apagando arquivos que estão a mais de 15 dias no local
Sub subDelFiles(strDest)
If objFSO.FolderExists(strDest) Then
WshShell.run "CMD.EXE /C attrib -r -a -s -h "& strDest &"\*.* /s /d"
'aqui é o comando onde precisa clocar a quantidade de dias de vida do arquivo
WshShell.run strPath & "\purger.exe -rde 15 "& strDest &"\*.*"
WshShell.run "CMD.EXE /C echo "& now &"> "& strDest &"\DELETAR.txt"
'Wscript.echo "Entrou no IF e chegou ao fim"
Else
'Wscript.echo "Entrou no Else! O if não foi verdadeiro"
End If
End Sub

Wscript.Quit
'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\FIM\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\