A solution for associating network traffic to enterprise users in a terminal services environment includes, at a network device configured as a terminal server, monitoring outbound network connections. If an outbound network connection is detected, a record is created indicating an association between the network connection and an enterprise user that initiated the network connection. The record is reported to a remote packet monitor which maintains a permanent log of the record. The permanent log may be used for tagging observed network traffic with an owning user.