Windows keeps a record of every Remote Desktop session, but not in one place. The details end up split across three different Event Viewer logs, none of them in the default Windows Logs path, so a straightforward search there usually turns up nothing.
Once you know which log holds which events, pulling a full session history takes a few minutes instead of an hour of guessing.
This guide covers where Windows stores incoming RDP logs and how to read them with Event Viewer and PowerShell. It also covers the Event IDs that matter most, plus where to look for outgoing connection logs if you need to check the client side of a session.
Where Windows Stores RDP Logs
RDP logs on the target machine live in three separate locations inside Windows Event Viewer:
• Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager > Operational covers session connect, disconnect, and logoff events (Event IDs 21, 23, 24, 25, 39, 40).
• Applications and Services Logs > Microsoft > Windows > TerminalServices-RemoteConnectionManager > Operational covers network-level connection events (Event ID 1149).
• Windows Logs > Security covers logon success, failure, and session audit events (Event IDs 4624, 4625, 4778, 4779).
All three logs record activity on the target machine, the one being connected to. To check which machines a user connected out to, see the Registry and RDPClient sections near the end of this article.
Key RDP Event IDs Explained
These are the Event IDs most administrators use when investigating Remote Desktop activity.
| Event ID | Log | Meaning |
| 1149 | TerminalServices-RemoteConnectionManager | Network-level RDP connection established (credentials validated) |
| 4624 | Security | Successful logon |
| 4625 | Security | Failed logon attempt |
| 21 | TerminalServices-LocalSessionManager | Remote session successfully created |
| 24 | TerminalServices-LocalSessionManager | Session disconnected |
| 25 | TerminalServices-LocalSessionManager | Session reconnected |
| 23 | TerminalServices-LocalSessionManager | Session logged off |
| 39 | TerminalServices-LocalSessionManager | User disconnected via the Start menu, or was disconnected by another session |
| 40 | TerminalServices-LocalSessionManager | Session ended (or reconnected) with a disconnect reason code |
| 4778 | Security | Session reconnected to a Window Station |
| 4779 | Security | Session disconnected from a Window Station |
Understanding Event ID 1149
Event ID 1149 causes more confusion than most RDP events, partly because of its label: “User authentication succeeded.”
On current versions of Windows, it fires once the client’s credentials have been validated over the network, before the full interactive sign-in and session creation happen. That’s different from the older behavior in versions prior to Windows 7 and Server 2012, when 1149 could log for any connection attempt regardless of whether the credentials were valid.
So 1149 does mean the credentials checked out, but it doesn’t mean the user ended up with a working session. Session limits, RDP permission restrictions, or licensing issues can still block the logon afterward. To confirm someone actually got in, correlate it with Event ID 4624 in the Security log or Event ID 21 in the LocalSessionManager log.
How to Check RDP Logs in Event Viewer
Event Viewer is the standard tool for viewing Remote Desktop Connection logs on Windows 10, Windows 11, and Windows Server 2016, 2019, and 2022.
Open Event Viewer by pressing Win + R, typing:
eventvwr.msc
and pressing Enter.
TerminalServices-LocalSessionManager (Session Events)
This is usually the first log to check because it records session logons, disconnects, reconnects, and logoffs.
Navigate to:
Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager
Select Operational. Click Filter Current Log. Enter the following Event IDs:
21,23,24,25,39,40
Click OK.
Each record includes the username, session ID, timestamps, and Source Network Address.
If Source Network Address contains a remote IP address, Windows recorded an incoming RDP session. If it displays LOCAL, the event represents a local console logon rather than Remote Desktop.
For example, if an administrator suspects someone accessed a Windows Server outside business hours, filtering for Event ID 21 shows every successful RDP session with its timestamp and source address.
TerminalServices-RemoteConnectionManager (Connection Attempts)
This log records the point where the RDP client’s credentials are validated over the network, before Windows completes the interactive sign-in and creates the session.
Navigate to:
Applications and Services Logs > Microsoft > Windows > TerminalServices-RemoteConnectionManager > Operational
Filter for:
1149
This log is useful when troubleshooting sign-in problems because it confirms the client’s credentials were accepted, even in cases where the session never fully opens because of permission or licensing restrictions afterward.
Correlate it with the Security log or Event ID 21 before concluding someone actually got into a working session, since credential validation and full logon completion aren’t the same thing.
Security Log (Authentication Events)
The Security log records successful and failed authentication attempts and requires administrator privileges.
Open:
Windows Logs > Security
Select Filter Current Log. Filter for:
4624,4625,4778,4779
Open a 4624 event and examine the Logon Type field.
A traditional Remote Desktop sign-in appears as Logon Type 10 (RemoteInteractive).
On systems using Network Level Authentication (NLA), which is enabled by default on modern versions of Windows, you’ll often see Logon Type 3 (Network) immediately before or alongside Logon Type 10.
Logon Type 3 alone does not identify an RDP session, because Windows uses it for many kinds of network authentication. Correlate it with Source Network Address, Event ID 1149, or Event ID 21 to determine whether the activity came from Remote Desktop.
How to View RDP Logs with PowerShell
PowerShell offers a faster way to search RDP logs than navigating Event Viewer, and it’s especially useful for scripting and exporting audit data.
To retrieve successful session creation events:
Get-WinEvent -LogName ‘Microsoft-Windows-TerminalServices-LocalSessionManager/Operational’ |
Where-Object {$_.Id -eq 21} |
Select-Object TimeCreated, Message |
Format-List
To search the Security log for successful Remote Desktop logons recorded today:
Get-WinEvent -FilterHashtable @{
LogName=’Security’
Id=4624
StartTime=(Get-Date).Date
} |
Where-Object {$_.Message -match ‘Logon Type:\s+10’}
To export session activity:
Get-WinEvent -LogName ‘Microsoft-Windows-TerminalServices-LocalSessionManager/Operational’ |
Where-Object {$_.Id -in 21,23,24} |
Export-Csv C:\rdp-session-log.csv -NoTypeInformation
One more thing worth checking before relying on historical logs: the TerminalServices-LocalSessionManager log overwrites older entries once it reaches its maximum size. On busy Remote Desktop Session Hosts, that can happen surprisingly quickly.
To increase the maximum log size:
wevtutil sl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /ms:20971520
This example increases the log to 20 MB. Adjust it based on how much history you need to keep. It buys more time before old entries get overwritten, but doesn’t make the log permanent unless retention is configured separately.
How to View Outgoing Remote Desktop Connection Logs
Everything covered so far records incoming RDP connections on the destination computer.
If you need to investigate which computers a user connected to from a Windows workstation, there are two useful data sources.
Registry (Connection History)
Open Registry Editor (regedit) and browse to:
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
The MRU0-MRU9 values contain the ten most recent hostnames or IP addresses used by the Remote Desktop client.
These entries provide destination history but do not include timestamps.
TerminalServices-RDPClient Log
If timestamps matter, check:
Applications and Services Logs > Microsoft > Windows > TerminalServices-ClientActiveXCore > Microsoft-Windows-TerminalServices-RDPClient > Operational
This log records outgoing client activity, including:
• Event ID 1024 – the RDP client attempting to connect to a server, logged the moment the connection is initiated
• Event ID 1102 – connection-sequence detail logged as the client establishes the session, including the destination IP address
Between the Registry entries and this log, you get both the destination history and the timestamps to go with it.
How HelpWire Records Session History
Windows Event Viewer wasn’t built for this kind of after-the-fact review. It’s an auditing and troubleshooting tool, so reconstructing one RDP session usually means pulling data from two or three separate logs and lining up timestamps by hand.
HelpWire handles this differently: each remote support session, attended or unattended, gets logged as a single chronological record: connection events, session details, and chat history together, with no cross-referencing needed once the session ends.
HelpWire secures remote sessions using TLS transport with AES-256 session encryption. On-demand sessions require explicit user approval before they begin, while unattended access must be configured with the client’s prior consent. That approval is reflected directly in the session record, instead of needing to be reconstructed from event logs afterward.
Because HelpWire supports Windows, macOS, and Linux for both operators and clients, the same session history is available regardless of the operating systems involved.
FAQ
Incoming RDP logs are split across three Event Viewer locations: TerminalServices-LocalSessionManager for session activity, TerminalServices-RemoteConnectionManager for network-level connections, and the Security log for authentication events. Checking all three is what gives you the full picture.
Open TerminalServices-LocalSessionManager > Operational, filter for Event ID 21, and sort the results by date. Each event includes the username, session ID, and source network address. You can correlate those events with Security log entries for additional authentication details.
Event ID 1149 is recorded once a remote client’s credentials are validated over the network. If the connection never reaches the target machine, the credentials are rejected before that point, or the TerminalServices-RemoteConnectionManager log is disabled, you won’t see the event. Keep in mind that 1149 confirms credential validation, not a completed Windows logon.
Windows retains RDP logs until each event log reaches its configured maximum size. Once the limit is reached, older events are overwritten unless log retention settings are changed. Increasing the log size allows more history to be preserved but does not make the logs permanent.
