The user connect\disconnect events are recorded in the GPOAdmin event log by default. Perform the following to ensure the auditing is enabled:
- In GPOAdmin, right-click the Domain and select "Options"
- Click the "+" next to the left-hand "Logging" menu
- Click "Configuration"
- Ensure "User actions" in "events to log" is selected
- Click OK
Perform the following to record GPOAdmin events in log files:
- In GPOAdmin, right-click the Domain and select "Options"
- Click the "+" next to the left-hand "Logging" menu
- Click "Configuration"
- Select "File System Folder"
- Choose a location to store the GPOAdmin log
- Click OK
A <date_stamp>.log file will then be created in the location specified. The log file will contain all GPOAdmin events including the user Connects\Disconnects. The user Connects\Disconnects will appear similar to the following:
2016-06-01 11:47:45Z, The user Domain\administrator successfully disconnected from the client Server-02., Domain\administrator, SuccessAudit, 3060, UserAction
2016-06-01 11:47:51Z, The user Domain\administrator successfully connected from the client Server-02., Domain\administrator, SuccessAudit, 3060, UserAction
