Really odd VPN problem

[Jay]

Windows 2000 Server, fully up to date, PPTP VPN.

Over the past few week I have noticed that in the logs I get this.

The user ******** connected on port VPN4-9 on 11/13/2007 at 00:51pm and disconnected on 11/13/2007 at 00:52pm. The user was active for 1 minutes 26 seconds. 0 bytes were sent and 0 bytes were received. The port speed was 12500000. The reason for disconnecting was user request.

you will see that the server records 0 bytes both ways (even though I know for a fact that this was a Remote Desktop session so there must have been some data sent!

Also note the reason for disconnecting

Now some times I notice this

The user ******** connected on port VPN4-9 on 11/13/2007 at 00:48pm and disconnected on 11/13/2007 at 00:49pm. The user was active for 0 minutes 49 seconds. 371114 bytes were sent and 82052 bytes were received. The port speed was 12500000. The reason for disconnecting was administrator's request.

The reason for disconnecting was different but this time it records the correct bytes sent....

I need to have these logs to give me a decent indication of what they are doing without going any deeper into the logs. High data low time means its not remote desktop etc.

I am having a really bad month up to now with stupid little things like this! Anyone have any clue as to why it is doing this?

[Moby-Dick]

Starred out that second username for you

this is using RRAS for VPN connections ?

why are you so worried about what each user is doing on the VPN ?

[Jay]

Thanks... went back into sort it and it was already done, though I was really losing my mind!

yes, RRAS. Because as I am an IT Pro I am paranoid! Also we have a few users who we are a bit "iffy" about and I like to see their internal bandwidth usage at all times (even when on the VPN)

This has worked in the past, but we have only just started to keep a close eye on these users. Looking deeper into this it looks like a possible Windows 2000 server bug.

Event 20048 Logged Byte Values Are "0" if RAS Disconnect Is by User

[Moby-Dick]

Surely if you've got sufficiently good ACL's / Group Policies in place then temptation for them to do something silly has been taken away

[Jay]

yes, but I still like to keep an eye on them at all times. Nothing I can really do about a bug, I wonder when that was introduced?