Windows event log · Microsoft-Windows-TerminalServices-RDPClient/Operational1025 RDP ClientActiveX has connected to the server
- Remote access
- 1 field
Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtxMicrosoft-Windows-TerminalServices-ClientActiveXCore
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData6
ActivityID: %ActivityID%- %ActivityID% = /Event/System/Correlation/@ActivityID
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-TerminalServices-ClientActiveXCore" Guid="28aa95bb-d444-4719-a36f-40462168127e"/>
<EventID>1025</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>101</Task>
<Opcode>10</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2020-11-28 10:17:22.6684714"/>
<EventRecordID>13</EventRecordID>
<Correlation ActivityID="cd839c41-3564-4fb9-afdd-e4b3abba0000"/>
<Execution ProcessID="2988" ThreadID="1672"/>
<Channel>Microsoft-Windows-TerminalServices-RDPClient/Operational</Channel>
<Computer>IEWIN7</Computer>
<Security UserID="S-1-5-21-3583694148-1414552638-2922671848-1000"/>
</System>
<EventData></EventData>
</Event>References
4 links
- cyber-tls.blogspot.com/2019/08/rdp.html(opens in new tab)
- social.technet.microsoft.com/wiki/contents/articles/37847.rdp-direct-connection-with-nla-remote-desktop-client-event-logs.aspx(opens in new tab)
- nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-TerminalServices-ClientActiveXCore.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1025.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)