How can I view the records and IP addresses of my computer being remotely controlled by others?

Question

My computer was remotely controlled by someone else and did some things. I need to query the IP address and detailed records of this remote computer.

Answer 1

Hi Nathan Chapman,

Thank you for posting in Q&A forum.

I understand that you currently want to query the history of mstsc remote desktop connections. You can refer to the following methods:

Win+R type eventvwr.msc to open the event viewer.

Navigate to: Applications and Services Logs > Microsoft > Windows > TerminalServices- RemoteConnectionManager, right-click "Operational" and select "Filter Current Log".

The event ID of Remote Desktop Services is 1149, so enter 1149 to filter the log.

Then you will get a list of events containing the history of all remote desktop connections to the server. Click one of them to see the details of the remote desktop connection, including IP address, computer name, login time, etc.

I hope the information above is helpful.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.