How can I view the records and IP addresses of my computer being remotely controlled by others?

Nathan Chapman 20 Reputation points
2024-06-05T09:57:08.8966667+00:00

My computer was remotely controlled by someone else and did some things. I need to query the IP address and detailed records of this remote computer.

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
36,964 questions
0 comments No comments
{count} votes

Accepted answer
  1. Zunhui Han 635 Reputation points Microsoft Vendor
    2024-06-05T12:09:38.36+00:00

    Hi Nathan Chapman,

    Thank you for posting in Q&A forum.

    I understand that you currently want to query the history of mstsc remote desktop connections. You can refer to the following methods:

    Win+R type eventvwr.msc to open the event viewer.

    Navigate to: Applications and Services Logs > Microsoft > Windows > TerminalServices- RemoteConnectionManager, right-click "Operational" and select "Filter Current Log".

    User's image

    The event ID of Remote Desktop Services is 1149, so enter 1149 to filter the log.

    User's image

    Then you will get a list of events containing the history of all remote desktop connections to the server. Click one of them to see the details of the remote desktop connection, including IP address, computer name, login time, etc.

    I hope the information above is helpful.

    Best regards

    Zunhui

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful