mopaprep.blogg.se - Terminal session manager

Start a new remote session: Ctrl + Shift + N.

2-terminals mode (horizontal split): Ctrl + Alt + 3.

2-terminals mode (vertical split): Ctrl + Alt + 2.

Print terminal output: Ctrl + Shift + P.

This is from a completely clean Windows 7 install.Note that all these shortcuts can be configured through "Settings" -> "Configuration" -> "MobaXterm keyboard shortcuts" button. It should contain the Workstation Name of the machine who logged in via RDP. I also found that in the security-event log there are Event IDs 4624. Maybe someone can come up with an easier solution :) That one just logs the hostname in the event) You could of course adapt the log.vbs to include username, remote ip. Note that also local logins will be logged (i haven't tested that yet because i'm on a remote :)

Now when someone logs in via RDP, their hostname is logged in c:\temp\rdp.log In Program type cscript.exe and in Add argument type c:\temp\log.vbs.In the Action-tab choose New and choose "Start a program".In "Log" choose Security and in "Event ID" type 4624.In the Trigger-tab choose New and choose "Begin the task" On an event.Click Start and type taskschd.msc then hit enter.Now for the last part create a scheduled task for starting this script. ObjFile.Write now() & " " & clientName & vbCrLf Set objFile=objFSO.OpenTextFile(outFile,ForAppending,True) Set objFSO=CreateObject("Scripting.FileSystemObject") SessionNumber = CInt(Trim(Mid(sOutput,iUserPos+iUserLen,iStatePos-iUserPos-iUserLen)))ĬlientName = LCase(oShell.RegRead("HKCU\Volatile Environment\"&sessionNumber&"\CLIENTNAME")) IUserLen = Len(oShell.ExpandEnvironmentStrings("%username%")) IUserPos = InStr(sOutput,LCase(oShell.ExpandEnvironmentStrings("%username%"))) Set oExec = oShell.Exec("query session %username%") Set oShell = CreateObject("WScript.Shell") (also edit the location of the desired logfile, here c:\temp\rdp.log) Function sessionNumberĭim oShell, oExec, sOutput, iUserPos, iUserLen, iStatePos Now create a VBScript-file (for example called c:\temp\log.vbs): Now check the Success box (failed attempts will not be logged this way).now navigate to Local Policy > Audit PolicyĪnd right click the Audit account logon events policy option and choose Properties.The Local Security Policy window will be displayed

Click Start and type secpol.msc then hit enter.I found this is needed because the other events triggered too early to get the hostname.