How do I find out who have been logged on

[koden]

Would like to see who have been logged on locally to my server the last week.

Only RDP user logons and not service logons.

Is that possible without looking security log manually?

[Tripredacus]

The regular security log doesn't seem to have that. I've found some things in this container in Applications and Services Logs -> Microsoft -> Windows:

Event ID 8001 in Operational log of GroupPolicy

Completed user logon policy processing for DOMAIN\RDPUser in 4 seconds

There may be more locations that are logged automatically. Maybe in your Security log, but mine just shows Audit results and none of them were showing any RDP logons.

[koden]

Thanks...

will try to look there..