PowerShell Script to Export RDP Session Logs to CSV

Question

Is it possible to obtain logs of RDP sessions? I want to generate a report on the logon, logoff, and the total session time for specific users. I went through this link (https://frsecure.com/blog/rdp-connection-event-logs/) to get the event IDs for logon, logoff, session disconnect, and connect event IDs. Can someone guide me in creating a PowerShell script that will export these logs to a CSV file?

The following is a table outlining the necessary event IDs to harvest: LOG ON:

Security	4624, 4625
TerminalServices-RemoteConnectionManager/Operational	1149
RemoteDesktopServices-RDPCoreTS /Operational	98, 131
TerminalServices-LocalSessionManager/Operational	21, 22, 25
LOG OFF:
Security	4634, 4647
TerminalServices-LocalSessionManager/Operational	23, 40

Answer 1

Hello @ Prakash Modak 

You can use the Get-WinEvent cmdlet to export specific event IDs from the Windows event logs. Then using the Export-Csv to export the results to a CSV file.

powershell - Export Specific Windows Security Event Logs - Stack Overflow

Get-WinEvent (Microsoft.PowerShell.Diagnostics) - PowerShell | Microsoft Learn