Overview
ManageEngine Log360 provides comprehensive monitoring of terminal servers, also known as Remote Desktop Services (RDS), for collecting, parsing, storing, analyzing, correlating, and archiving relevant Windows event logs. This enables effective management of user sessions, detection of suspicious activities, streamlined troubleshooting of connection issues, and enhanced security within your remote access environment. Log360 delivers the insights needed for robust log management, threat detection, investigation, and response specific to your terminal server infrastructure.
How Log360 collects and analyzes terminal server logs
Log360 simplifies the management of terminal server logs through adaptable collection methods and intelligent processing:
Collection methods:
- Agent-based: Secure and reliable forwarding of logs is crucial for production terminal servers and complex deployments. An agent installed directly on the terminal server buffers logs locally to prevent data loss during network interruptions, compresses logs to optimize bandwidth utilization, and securely transmits data using encrypted protocols. This ensures a robust and consistent stream of user activity and system event logs crucial for auditing and threat detection.
- Agentless: Leverages native Windows management protocol like WMI for easy deployment across numerous terminal servers.
Monitoring capabilities
Log360 gathers and analyzes key Windows event logs related to Terminal Services, including:
- Security Logs: Successful and failed logon attempts, account lockouts, and privilege use related to remote sessions.
- System Logs: Service operations for Remote Desktop Services, system startup and shutdown events on the terminal server, and resource-related issues.
- Application Logs: Errors, warnings, and informational events specific to Remote Desktop Services and related applications.
- TerminalServices-LocalSessionManager: Events related to user session establishment, disconnection, and reconnection.
- TerminalServices-RemoteConnectionManager: Events concerning incoming and outgoing remote desktop connections.
Critical terminal server events monitored
Log360 tracks essential terminal server activities, including:
- Successful and failed user logon attempts via RDP
- User session connect and disconnect events
- Session duration and activity
- Attempts to access restricted resources within the remote session
- Application errors and crashes within user sessions
- Profile loading and unloading issues
- Temporary profile usage
- Disconnections due to network issues or server problems
- Unauthorized connection attempts
Key benefits
- Centralized visibility: Monitor all Terminal Servers from a single, unified console, eliminating the need to access individual servers for log analysis.
- Real-time session monitoring: Gain insights into active and disconnected user sessions, helping to identify unusual activity or performance bottlenecks.
- Enhanced security: Detect suspicious logon attempts, unusual session duration, or attempts to access sensitive files within remote sessions.
- Streamlined troubleshooting: Quickly diagnose the root cause of connection problems, application errors within sessions, or profile issues by analyzing centralized logs.
- Capacity planning: Understand peak usage times and user session trends to plan for terminal server capacity effectively.
Address key terminal server management challenges
| Challenges |
Solution offered by Log360 |
| Monitoring user activity in remote sessions |
Track logon/logoff times, session duration, and application usage within remote sessions to identify unusual behavior or potential misuse. |
| Detecting unauthorized access to terminal servers |
Identify brute-force attacks, failed logon attempts from unknown sources, and other indicators of unauthorized access to your remote desktop environment. |
| Troubleshooting connection and performance issues |
Analyze logs related to session establishment, disconnections, and application errors to quickly pinpoint the cause of user-reported problems. |
| Auditing remote access activities |
Maintain a detailed audit trail of all remote desktop connections, user sessions, and activities for security analysis and compliance requirements. |
| Identifying potential security threats within sessions |
Correlate logon events with application usage and file access activities within remote sessions to detect potential malware or insider threats. |
Beyond basic monitoring: optimize performance, detect unusual user behavior, and secure remote logins. Ensure seamless, compliant, and threat-free access.
Build an impenetrable and efficient remote access backbone with Log360.
