Remote Desktop Event ID 24: Remote Desktop Services: Session has been disconnected
Written when a Remote Desktop session is disconnected.
- Log
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Category
- Remote Desktop
Why it matters
- Use with 21 and 25 to map when a remote user was connected.
What to check
Match the Session ID with 21 and 25.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol