How to find out who kicked another user?

1

I have a couple of users, connected to an RDP server (jump server, let's call it RDP-1 Windows server 2008 R2) and from there to another RDP (let's call it RDP-2 Windows Server 2008 R2) where they run client-server applications.

All of them, are administrators in RDP-2, and they are using the same client-server application with a restricted number of licenses (which we cannot increase).

It happened frequently, that some of the users complained about being disconnected suddenly. It is suspected that, some other users kicked logged them off or disconnected them from the RDP Manager as they have access to it and the privilege to do so.

I have tried to find out how to track this issues (a user disconnected suddenly) and discover if - someone behind this- using Windows Event Viewer and Application logs, but nothing tell if the termination is caused by another user/admin.

I would appreciate if you guide me how trace this activities.

Regards,

H.

helhadad

Posted 2018-11-07T09:54:20.453

Reputation: 11

All of them, are administrators in RDP-2 Alter it. Deny them the right to disconnect someone else's session. – Akina – 2018-11-07T10:33:59.760

I cannot as, I need them to be a member of the administrator group, as a requirement for some remote applications to work properly. – helhadad – 2018-11-07T20:25:08.310

Answers

0

Try to check the event 24 in here.

enter image description here

enter image description here

qi SONG

Posted 2018-11-07T09:54:20.453

Reputation: 214

Thanks @qi Song for your answer, however, it does not tell me if the disconnection was happened by the logged user or another user. – helhadad – 2018-11-08T11:37:44.840

Asked: 2018-11-07T09:54:20.453

Viewed: 119 times

Active: 2018-11-08T03:33:19.970