Chapter 5 Logon/Logoff Events
RDP Event Log DFIR – DFIR on the Mountain
Making Sense of RDP Connection Event Logs | FRSecure
RDP Event Log DFIR – DFIR on the Mountain
Making Sense of RDP Connection Event Logs | FRSecure
Tracking and Analyzing Remote Desktop Connection Logs in Windows | Windows OS Hub
Chapter 6 Detailed Tracking Events
4634(S) An account was logged off. - Windows Security | Microsoft Learn
Windows RDP-Related Event Logs: The Client Side of the Story
4624(S) An account was successfully logged on. - Windows Security | Microsoft Learn
Tutorial: How to Check RDP Windows Server Connection Logs
Tutorial: How to Check RDP Windows Server Connection Logs
4625(F) An account failed to log on. - Windows Security | Microsoft Learn
Auditing Remote Desktop Services Logon Failures (Part 1) - PureRDS
Making Sense of RDP Connection Event Logs | FRSecure
Windows RDP-Related Event Logs: Identification, Tracking, and Investigation | Ponder The Bits
Making Sense of RDP Connection Event Logs | FRSecure
Windows RDP-Related Event Logs: Identification, Tracking, and Investigation | Ponder The Bits
Tracking and Analyzing Remote Desktop Connection Logs in Windows | Windows OS Hub
Tracking and Analyzing Remote Desktop Connection Logs in Windows | Windows OS Hub
Making Sense of RDP Connection Event Logs | FRSecure
Tracking and Analyzing Remote Desktop Connection Logs in Windows | Windows OS Hub
RDP Event Log DFIR – DFIR on the Mountain
Windows RDP-Related Event Logs: Identification, Tracking, and Investigation | Ponder The Bits
Windows Event ID 4624, successful logon — Dummies guide, 3 minute read
How do I find the source IP of an RDP connection from a Windows login while using Duo for Windows Logon?
