IT admins and gurus...

[tpunx99GSX]

hey guys,
Just wondering if any of you guys know a way to find out when someone logged into and out of a terminal session (via Terminal Server or Windows Active Directory) in Windows Server 2003.
Some POS company is trying to take our company to small claims court because they sent us a bill for $2500 bucks to fix a problem we were having with one of our accounting applications, and they charged us for like 15 hours of work, and the work was never completed, in fact nothing was done, so basically we paid for research to be done on the system. So basically i want to find out whether they had even logged into the server or how long they were actually in the server.... I had set up a seperate User Login for them to log into the terminal services.
So if you know a way please let me know, thanks
Tom

[scheides]

Microsoft, in their infinite wisdom, does not have a logging facility setup for TS. However, you can look in the event viewer for telltale signs that they logged in, such as loading of prefs, printing notifications, etc.

There are third party utilities out there for this, I haven't set any up but...hrm, I think I will.

[tpunx99GSX]

Actually i was looking at the Event viewer in the Security Audit which tells when there was a login, only thing that sucks is that the log size was set to 16 megs which only goes back to January 25th, 2007. OWNED BY LOG SIZE dammit