none
Remote Desktop login

    Question

  • hi gurus, if I use RDC to login to one of my server.

    Is there a record in event viewer the name of the computer that I used to RDC to server?

    Or how to check the names of the computer that had connected remotely to the server?

    Thanks. 


    Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Tuesday, January 14, 2014 4:13 AM

Answers

  • Hi,

    According to your comment, you can look for below event id for detail information.

    Under Windows log > Security

    Event ID – 4624: Appear if an account was successfully logged on
    Event ID – 4625: Appear if an account cannot able to successfully logged on

    If you are using RDS Server then you can also use below logs for detail.

    Under Application and Service Logs > Microsoft > TerminalServices-RemoteConnectionManager
    Event Id – 1149

    Hope it helps to understand!

    Thanks,
    Dharmesh
    • Marked as answer by cguan Thursday, January 16, 2014 2:02 AM
    Wednesday, January 15, 2014 8:53 AM
    Moderator
  • Hi Dharmesh, Thanks for your reply.

    I did some homework, logon type 10 is remote interactive login. Logs can be found on Security Event Viewer.

    The Event log some details, of the username and the IP Address of the workstation which was used to RDC to the target server.

    Thanks :)


    Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    • Marked as answer by cguan Thursday, January 16, 2014 2:02 AM
    Thursday, January 16, 2014 2:02 AM

All replies

  • Hi,

    According to your comment, you can look for below event id for detail information.

    Under Windows log > Security

    Event ID – 4624: Appear if an account was successfully logged on
    Event ID – 4625: Appear if an account cannot able to successfully logged on

    If you are using RDS Server then you can also use below logs for detail.

    Under Application and Service Logs > Microsoft > TerminalServices-RemoteConnectionManager
    Event Id – 1149

    Hope it helps to understand!

    Thanks,
    Dharmesh
    • Marked as answer by cguan Thursday, January 16, 2014 2:02 AM
    Wednesday, January 15, 2014 8:53 AM
    Moderator
  • Hi Dharmesh, Thanks for your reply.

    I did some homework, logon type 10 is remote interactive login. Logs can be found on Security Event Viewer.

    The Event log some details, of the username and the IP Address of the workstation which was used to RDC to the target server.

    Thanks :)


    Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    • Marked as answer by cguan Thursday, January 16, 2014 2:02 AM
    Thursday, January 16, 2014 2:02 AM