Windows 7 - RDP Sessions - noted in the event log?

Asked By Greg Brown on 01-Jun-11 06:43 PM

Wanting to know if a RDP session (from a Windows 7 system) is noted in the event log (of the PC initiating the session), and if so, what would the notation look like? Thanks!

Riley K replied to Greg Brown on 02-Jun-11 12:34 AM

I dont know if there's something specific for RDP, btw you could

enable an Audit Policy for Logons on the workstation (you can do it via GPO if you're on a Active Directory domain or you can do it on a single workstation editing its Local Security Policy)
check Events in Security with Event Code = 528 (User logged in) and Logon Type = 10 (Remote Interactive, so RDP like connections)

you can query Events i.e. using LogParser (GUI here) and maybe load them in a DB for future analysis

Kirtan Patel replied to Greg Brown on 03-Jun-11 03:14 AM

Look in the Event Log (Security) for a Logon/Logoff Event 528. It should have a Logon Type 10...

You can setup an Audit Policy using the Group Policy editor to log logon success and failures. Go
to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer Policy ->
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
desired. Note, some folks have XP boxes setup to login without a password. Logging in
without a password counts as a "failure". This results in the security log filling up very fast if
you log failures and have a user without a password. I fell into that trap while testing a new XP
Pro box once. The result is you can not login normally. Also note, not having a password is
a potential and probable security risk.

Greg Brown replied to Greg Brown on 03-Jun-11 03:47 PM

Thanks for the response; however, I know I have initiated several RDP sessions from my PC in the last 6 months but did not find one entry in the Security event log with Event 528. In fact, event code 1100 is lowest code found. Now, I did follow your instructions to modify the "Audit logon events" via the gpedit.msc command but the properties detail states: "This security setting determines whether the OS audits each instance of a user attempting to log on to or to log off to this computer.". The way I read this, it has nothing to do with logging a RDP session where I am logging into another PC, it will only note users logging in/out of my PC. Make sense? I know the server I'm remoting into records my activity in the server event log, but does my PC note my RDP session in my PC event log...? I think we are are on the right track but perhaps not referencing the correct auditing option on my PC to make the event log entry. Your thoughts?

Greg Brown replied to Kirtan Patel on 03-Jun-11 03:49 PM

Thanks for the response; however, I know I have initiated several RDP sessions from my PC in the last 6 months but did not find one entry in the Security event log with Event 528. In fact, event code 1100 is lowest code found. Now, I did follow your instructions to modify the "Audit logon events" via the gpedit.msc command but the properties detail states: "This security setting determines whether the OS audits each instance of a user attempting to log on to or to log off to this computer.". The way I read this, it has nothing to do with logging a RDP session where I am logging into another PC, it will only note users logging in/out of my PC. Make sense? I know the server I'm remoting into records my activity in the server event log, but does my PC note my RDP session in my PC event log...? I think we are are on the right track but perhaps not referencing the correct auditing option on my PC to make the event log entry. Your thoughts?