Introduction
any ISA Administrators wanted to know how they can create a report to log who established a VPN Connection into their Networks, when these users established the VPN connections and what did they access ? In this article we will create reports that log VPN Users for the past 30 days and show us in details who established a VPN Connection, when did they establish the VPN connection, and what these VPN Users accessed to.
Configuration on ISA Server
1. Open ISA Management Console
2. Under the Monitoring node, click on Logging
3. We will create a report with the following filters
a. Logging Last 30 Days
b. Action Equals Initiated VPN Connection
4. Click on Edit Filter, to start editing and adding our filters.
5. Click on Log Time, then under the Condition drop down list, choose Last 30 Days, and click on Update
6. Click on Action, then under the Condition drop down list, choose Equals, and under the Value drop down list choose  Initiated VPN Connection and click on Update
7. The Filter will look like
8. Click on the Start Query, the Query will run and the results will be displayed
As you can see, the user tmajdalani has established 3 PPTP VPN connections during the last 30 days
9. Now, to copy the results to Excel, on the Right Side Pane, under Tasks, click on Copy All Result to Clipboard
10. Now open Microsoft Excel , and paste the result.Ok we knew how to log who established a VPN Connection into our Network, but what if I want to know in details what these VPN users accessed to ?
11. Of course, to Allow VPN Users to access resources inside your LAN , you will need to create an Allow rule as shown:
Create the following Filters: 
Where the value VPN Inbound Access is the access rule that we mentioned in the previous step.
Now run the Query and check what your VPN Users have been doing all these 30 days 
Summary
In this article, we learned how to log all the VPN Connections established into our Network through ISA Server. Now we know who , when and to what resources your VPN users accessed.
