Event ID 25 — Reconnection to a RDP session

A user has reconnected to an existing RDP session.

Source of event

Microsoft-Windows-TerminalServices- LocalSession (2001) — RDP category.

Possible causes

• Resumption after disconnection
• Back to a session held

Verifications to be carried out

1. Compare Session ID with the event 24
2. Check the user

Useful orders.

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object Id -eq 25 | Select-Object -First 20

To be retained.

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.