Event ID 1149 — Successful RDP authentication

The RDP service successfully authenticated a user for a Viare connection

TopicIT resources → About 1 min read

The RDP service successfully authenticated a user for a Viare connection.

Source of event

Microsoft-Windows-TerminalServices-Remote-Monnegro (2001) — RDP category.

Possible causes

Normal RDP connection
Administration

Verifications to be carried out

Identify the user and the source address in the dedicated log
Correlate with Security 4624 Logon Type 10

Commands

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' | Where-Object Id -eq 1149 | Select-Object -First 20

Key takeaways

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.