microsoft_windows:terminalserver:rdplogs
Table of Contents
Server Remote Desktop Logs
Unlike Unix, Windows logs are binary files, so you can not simply search them. And, sometimes it is difficult to find the entries you want, but it is not impossible.
You will need to find the correct submenu in the Events Viewer, then look through the entries there. Logs can be filtered, and exported in various formats.
Find Terminal Services Log
Open Control Panel, go to Event Viewer, then find
Applications and Services Logs | Microsoft | Windows | TerminalServices-LocalSessionManager | Operational
Applications and Services Logs Microsoft Windows TerminalServices-LocalSessionManager Operational
Filter to get what you want
- On right, click on Filter Current Log
- Set Logged to date range, or leave as all
- Set Event ID to 25 (that is the event ID for a login)
- Click “Ok”
Export the information
You have several options to export the data you filter
- On right, click Save Filters Log File As..
- Save it as an XML or a TXT (tab delimited)
- Open Microsoft Excel
- Open the file.
- clean up unnecessary columns
- Save as Excel workbook
Links
microsoft_windows/terminalserver/rdplogs.txt · Last modified: 2020/01/22 17:56 by rodolico