Remote Desktop Event ID 1149: Remote Desktop Services: User authentication succeeded
Written when a Remote Desktop connection is made and a user name is supplied, with the source IP address.
- Log
- Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
- Category
- Remote Desktop
Why it matters
- Despite the title, it records a network connection, not a successful logon. Confirm the logon with 4624 type 10 or LocalSessionManager 21.
- A useful record of RDP source IPs, kept separately from the Security log.
What to check
Check User, Domain and Source Network Address, then find the matching 4624 type 10.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol