Remote Desktop Event ID 25: Remote Desktop Services: Session reconnection succeeded
Written when someone reconnects to an existing disconnected session, with the source address.
- Log
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Category
- Remote Desktop
Why it matters
- A reconnection from a different IP than the original logon can mean someone else took over the session.
What to check
Compare Source Network Address with the one in the original 21.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol