Windows event log · Microsoft-Windows-TerminalServices-RDPClient/Operational1102 RDP client has initiated a multi-transport connection to the server
- Remote access
- 1 field
Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtxMicrosoft-Windows-TerminalServices-ClientActiveXCore
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData1
Address: %Address%- %Address% = /Event/EventData/Data[@Name="Value"]
Sample event
Event XML from the map file
The client has initiated a multi-transport connection to the server 192.168.1.179.
<Event>
<System>
<Provider Name="Microsoft-Windows-TerminalServices-ClientActiveXCore" Guid="28aa95bb-d444-4719-a36f-40462168127e"/>
<EventID>1102</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>101</Task>
<Opcode>10</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2018-09-05 11:53:15.6282883"/>
<EventRecordID>83</EventRecordID>
<Correlation ActivityID="a5c05495-8936-44ea-a09b-da190c410000"/>
<Execution ProcessID="5012" ThreadID="8892"/>
<Channel>Microsoft-Windows-TerminalServices-RDPClient/Operational</Channel>
<Computer>base-rd-01.shieldbase.lan</Computer>
<Security UserID="S-1-5-21-3445421715-2530590580-3149308974-1193"/>
</System>
<EventData>
<Data Name="Name">ServerAddress</Data>
<Data Name="Value">172.16.4.5</Data>
<Data Name="CustomLevel">Info</Data>
</EventData>
</Event>References
6 links
- cyber-tls.blogspot.com/2019/08/rdp.html(opens in new tab)
- social.technet.microsoft.com/wiki/contents/articles/37847.rdp-direct-connection-with-nla-remote-desktop-client-event-logs.aspx(opens in new tab)
- nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/(opens in new tab)
- docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdsod/aa0449fc-9642-4206-90a8-aac72f1b72fd(opens in new tab)
- frsecure.com/blog/rdp-connection-event-logs/(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-TerminalServices-ClientActiveXCore.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1102.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)