IT Toolbox
IT Toolbox

Event ID 21 — Opening of a RDP session

TopicWindows Server →
View my favorites

A Terminal Services session has been successfully opened.

Source of event

Microsoft-Windows-TerminalServices- LocalSession (2001) — RDP category.

Possible causes

  • RDP connection
  • User login

Verifications to be carried out

  1. Identify Session ID
  2. Correlate with 1149 and 4624
  3. Check the source address according to other newspapers

Useful orders.

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object Id -eq 21 | Select-Object -First 20

To be retained.

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

♡ 0