Log of IP addresses accessing Windows 2012 Server

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

paul_carron

Thread Starter
Joined
Oct 15, 2006
Messages
207
Hi,

Is there any history or log on a Windows 2012 Server that will detail IP addresses that connected to the server? I've noticed a few pretty serious changes to settings on the server. Unfortunately the whole team uses the same logon(a problem I know) so I want to trace the IP address. I know the date and time the change was made so if I can get the IP address of any device that was connected at that time I think I'll know who made the changes.

Cheers
Paul
 
Joined
Sep 21, 2007
Messages
13,182
If you have enabled logging for "Audit account logon events" and "Audit logon events" in Local Security Policies > Local Policies > Audit policy. Then any account logon will generate an event viewer log entry.

In Event Viewer, create a custom view and filter for Event ID's 4624,4636,4803,4801. These are all logon events. Then hunt for Logon Type: 3 manually, ( type 3 means network logon ) and you will see Source Network Address in the same log entry.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top