DFIRHub

Windows event log · Microsoft-Windows-TerminalServices-LocalSessionManager/Operational40 Session (PayloadData1) has been disconnected, reason code (PayloadData2)

  • Remote access
  • 2 fields
  • Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
  • Microsoft-Windows-TerminalServices-LocalSessionManager

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1Session: %Session%
    • %Session% = /Event/UserData/EventXML/Session
  • PayloadData2Reason: %Reason%
    • %Reason% = /Event/UserData/EventXML/Reason

Value lookups

Codes that EvtxECmd turns into text

Reason

0
No additional information is available (i.e. the user has closed RDP window)
1
The disconnection was initiated by an administrative tool on the server in another session
2
The disconnection was due to a forced logoff initiated by an administrative tool on the server in another session
3
The idle session limit timer on the server has elapsed
4
The active session limit timer on the server has elapsed
5
The client's connection was replaced by another connection (i.e. a user reconnected to a previous RDP session)
6
The server ran out of available memory resources
7
The server denied the connection
9
The user cannot connect to the server due to insufficient access privileges
10
The server does not accept saved user credentials and requires that the user enter their credentials for each connection
11
The disconnection was initiated by the user disconnecting his or her session on the server or by an administrative tool on the server
12
The disconnection was initiated by the user logging off his or her session on the server

Sample event

Event XML from the map file

<Event
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5d896912-022d-40aa-a3a8-4fa5515c76d7}"/>
    <EventID>40</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x1000000000000000</Keywords>
    <TimeCreated SystemTime="2019-08-05T18:29:24.930754500Z"/>
    <EventRecordID>732</EventRecordID>
    <Correlation ActivityID="{[GUID]}"/>
    <Execution ProcessID="1200" ThreadID="1056"/>
    <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <EventXML xmlns="Event_NS">
      <Session>2</Session>
      <Reason>5</Reason>
    </EventXML>
  </UserData>
</Event

References

5 links

Source: evtx/Maps/Microsoft-Windows-TerminalServices-LocalSessionManager-Operational_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map(opens in new tab) by Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)