detection on RDP connection since last 3 months

Question

I would like to confirm if RDP connection has been performed (either successfully connected or fail) in my PC since last 3 months. What kind of powershell script should do this task? Thankyou!

Answer 1

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to

Event Logs located in Event Logs “Applications and Services Logs -> Microsoft -> Windows -> Terminal-Services-RemoteConnectionManager > Operational”

Also you can use below powershell to check the logs

Get-EventLog security -after (Get-date -hour 0 -minute 0 -second 0) | ?{$.eventid -eq 4624 -and $.Message -match 'logon type:\s+(10)\s'} | Out-GridView

Reference :

https://learn.microsoft.com/en-us/answers/questions/486771/how-to-collect-rdp-access-logs-for-my-windows-mach

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

PowerShell would retrieve that information from the Windows Security Event Log by using the Get-WinEvent cmdlet. See here for how to enable auditing and the different types of logons: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

Make sure you have set a sufficiently large size limit on the security log. Auditing can quite chatty.