Windows event log · Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational1149 RDP network connection established
- Remote access
- 2 fields
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtxMicrosoft-Windows-TerminalServices-RemoteConnectionManager
Fields EvtxECmd extracts
2 columns in the EvtxECmd CSV
- UserName
%domain%\%user%- %domain% = /Event/UserData/EventXML/Param2
- %user% = /Event/UserData/EventXML/Param1
- RemoteHost
%Address%- %Address% = /Event/UserData/EventXML/Param3
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="c76baa63-ae81-421c-b425-340b4b24157f"/>
<EventID>1149</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x1000000000000000</Keywords>
<TimeCreated SystemTime="2018-11-06 21:45:50.4112641"/>
<EventRecordID>6</EventRecordID>
<Correlation/>
<Execution ProcessID="812" ThreadID="1956"/>
<Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational</Channel>
<Computer>IEWIN7</Computer>
<Security UserID="S-1-5-20"/>
</System>
<UserData>
<EventXML>
<Param1>administrator</Param1>
<Param2>ie11win7</Param2>
<Param3>10.0.2.16</Param3>
</EventXML>
</UserData>
</Event>References
7 links
- ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/(opens in new tab)
- 13cubed.com/downloads/rdp_flowchart.pdf(opens in new tab)
- dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/(opens in new tab)
- woshub.com/rdp-connection-logs-forensics-windows/(opens in new tab)
- countuponsecurity.com/2015/11/25/digital-forensics-supertimeline-event-logs-part-ii/(opens in new tab)
- frsecure.com/blog/rdp-connection-event-logs/(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-TerminalServices-RemoteConnectionManager.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-TerminalServices-RemoteConnectionManager-Operational_Microsoft-Windows-TerminalServices-RemoteConnectionManager_1149.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)