Remote Desktop Event ID 21: Remote Desktop Services: Session logon succeeded
Written when a user logs on to a session on the machine, with the source address for remote sessions.
- Log
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Category
- Remote Desktop
Why it matters
- Kept separately from the Security log, so it can survive if the Security log is cleared.
What to check
Check User, Session ID and Source Network Address.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol