Terminal Services Gateway

Applies To: Microsoft Windows Server 2008 and later

Overview

Windows Server 2008 Terminal Services Gateway (TS Gateway) is a role service that enables authorized remote users to connect to resources on an internal corporate or private network, from any Internet-connected device that can run the Remote Desktop Connection (RDC) client. The network resources can be terminal servers, terminal servers running RemoteApp programs, or computers with Remote Desktop enabled.

EventTracker gathers and examines acquired logs to identify terminal server configurations, terminal server connections, terminal server desktop host activity. It generates reports for terminal services user session connected, user session disconnected, user authentication success, user authentication failed, and network traffic activity. It displays authentication success and failed with username’s, user session connected, and network traffic by systems. It alerts the users when terminal services gateway is shutting down and user authentication fails.

EventTracker Knowledge Pack for Terminal Services Gateway allows you to monitor the following components:

Security - User session connected and disconnected to network resources, and user authentication failed
Operations - User authentication success
Compliance - Network traffic inbound and outbound

Previous Next

Once Terminal Services Gateway is configured to deliver events to EventTracker alerts, dashboards, and reports can be configured into EventTracker.

Security

Alerts

Terminal Service Gateway: User authentication failed – This alert will trigger whenever user tries to authenticate but fails.
Terminal Service Gateqay: Gateway service shutdown – This alert will trigger whenever RD gateyway service is shutting down.

Reports

Terminal Services Gateway - Network resource connected or disconnected – This report provides information related to session connected and disconnected to network resources, username, network resource name, IP address, data transferred, data downloaded, etc.

Terminal Services Gateway - Authentication failed - This report provides information related to authentication failure for a user, reason for failure, device name, username, and IP address.

Operations

Reports

Terminal Services Gateway - Authentication success – This report provides information related to authentication success for a user, IP address, username, etc.

Compliance

Reports

Terminal Services Gateway - Network traffic detail – This report provides information related network inbound and outbound traffic, IP address, username, etc.

Scope

The configuration details are consistent with EventTracker version 9.2 and later, and Microsoft Windows Server 2008 and later.

Documentation:

To configure Terminal Services Gateway to send logs to EventTracker, refer to the How-to Guide.

For more information please refer to the Integration Guide.