I wonder if the windows saves the historic of access ts? If yes, how did I find out who logged in?

Hi Yanhke, Take a look in the “Event Viewer” at the following log: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational You can use Powershell to filter out the LOCAL logon events using: $remoteLogonEvents = Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-TerminalServices-LocalSessionManager"} | ?{$_.properties[2].Value -ne "LOCAL"} Then you can use Format-List to see who performed what action: $remoteLogonEvents | Format-List Reference: http://technet.microsoft.com/en-us/library/ee891289(WS.10).aspx Thanks, John