There are a few ways that you can tell who is accessing your Windows server. The first way is to check the event logs. You can find these in the Event Viewer, which is located in the Administrative Tools section of the Control Panel. Expand the System log and look for events with a Source of Security-Auditing. These will show you who has logged on to your server, as well as when they logged on and what type of logon they used (e.g., interactive, remote desktop, etc.).
Another way to see who is accessing your server is to use the Netstat command. This will show you all of the active connections to your server, as well as what program or service each connection is associated with. To use Netstat, open a Command Prompt window and type netstat -a. This will show you all active TCP connections on your server. If you want to see all active UDP connections as well, use the -u switch instead of -a.
You can also use Task Manager to see what programs or processes are currently running on your server. This can be helpful in determining if there are any suspicious programs or services running that may indicate someone is trying to gain unauthorized access to your system. To open Task Manager, press Ctrl+Alt+Delete and click on Task Manager from the menu that appears. Then, click on the Processes tab and take a look at the list of programs and processes that are currently running