Is there a log file for RDP connections?

Question

I connect to my work PC via VPN/RDP and I would like to find a log file on my work PC that would include some information on when I used it last, from where my connection originated and how long it lasted. Where in Windows 7 would I look to find that out?

Answer 1

If you look at the event viewer as the administrator there are server logs but not for login/logout as far as I know.

Please check the Event Viewer tree on the left side under "Applications and Services Logs -> Windows -> TerminalServices-*" where * is all of the logs there. I think you are most interested in the TerminalService-LocalSessionManager Operational log. Event ID 21 will provide the IP address of the incoming connection.

There is also a "RemoteDesktopServices-RemoteDesktopSessionManager" node in the event viewer tree on the left side under "Applications and Services Logs -> Windows". Only the Administrator role is allowed to view the file I believe. Please confirm and let me know if this addresses your use case.

Maybe try this for logging login/logout as well: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/aptopnode.mspx?mfr=true

Answer 2

Look under 'Application and Services Logs' > 'Microsoft' > 'Windows' > 'TerminalServices-ClientActiveXCore' > 'Microsoft-Windows-TerminalServices-RDPClient/Operation' ,

This log will have events which contain the server name which the end user attempted to connect RDP into.

Answer 3

I can't tell you how to check from your work machine when you established a VPN as presumably it isn't the VPN server (?). However, if you're using Remote Desktop Connection to control that work PC you may be able to pull the logon / logoff times from the Event Viewer.

Look in the Security logs for those. RDP logons are an Event ID 4624 but just searching for 4624 won't work. Within the event you need the Logon Type value to be "10" and the SecurityID value to be yours. Not sure how to filter those...

Answer 4

Use the command quser to show sessions.

Then you will see something like ID 1 or 2 or 4. Then type Logoff 4 to log off that session.

You can also type query session or qwinsta (both are the same thing) Show's who's on and what port is listening etc.

Answer 5

I found the information in the Event Viewer under Windows Logs/Security you will see under task category logon and logoff events.

Answer 6

In your case, you need to review TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs from your computer.

You can also check an excellent third party tool called SysKit, formerly Terminal Services Log. It will generate you all sort of reports from logs and will save you a bunch of time if you want to get all of the details about RDP connections and other stuff.

Please note: I am affiliated with Acceleratio, the makers of the tool mentioned above, so I might be a little bit biased here.