Event Source: RemoteAccess Event Category: None Event ID: 20192 Date: 6/9/2012 Time: 2:25:49 PM User: N/A Computer: [ServerNameHere]
What does the sessionid and event ID 21 mean?
For remote RDP logons, take note of the SessionID as a means of tracking/associating additional Event Log activity with this user’s RDP session. TL;DR: Indicates successful RDP logon and session instantiation, so long as the “Source Network Address” is NOT “LOCAL”. Notes: This typically immediately proceeds an Event ID 21.
What does the “source network address” of event ID 21 mean?
This event with a “Source Network Address” of “LOCAL” will also be generated upon system (re)boot/initialization (shortly after the preceding associated Event ID 21). TL;DR: Indicates successful RDP logon and shell (i.e. Windows GUI Desktop) start, so long as the “Source Network Address” is NOT “LOCAL”.
What is event ID 39 and 40 in RDP?
Typically paired with Event ID 24 and likely Event ID’s 39 and 40. The SessionName, ClientAddress, and LogonID can all be useful for identifying the source and associated activity. TL;DR: The user disconnected from from an RDP session.
What is an event log ID?
This ID is unique for each logon session and is also present in various other Event Log entries, making it theoretically useful for tracking/delineating a specific user’s activities, particularly on systems allowing multiple logged on users.
Network Connection
This section covers the first indications of an RDP logon – the initial network connection to a machine.
Authentication
This section covers the authentication portion of the RDP connection – whether or not the logon is allowed based on success/failure of username/password combo.
Logon
This section covers the ensuing (post-authentication) events that occur upon successful authentication and logon to the system.
Logoff
This section covers the events that occur after a purposeful (Start -> Disconnect, Start -> Logoff) logoff.
Wrap-Up
Hopefully that provides a little better insight into some of the most common and (IME) most empirically useful RDP-related Event logs, when/where you might encounter them, what they mean, what they look like, and (most importantly) how they all fit together.