As in the subject. I think it would be a good to know as much as possible things to check who or what removed my RDP session. For instance, we have a developer console server, where we do some development and many times we leave the sessions disconnected to continue the work the following day. Sometimes happens that the session is closed/removed by something or somebody.
I just would like to know the most possible list of to check to find the root cause on Windows Server 2003, 2008, 2012 editions. I gathered the following.
Check if:
- there was the reboot of a server (eg. by patching activities) – checking NT event log id: 1074
- the RDP service was stopped/restarted – any ideas?
- the session has been removed by human – is this activity logged in NT event log?
Can you please answer the questions and may you have any other ideas and?