Event ID 24 — Logout of,an RDP session

A RDP session was disconnected without necessarily being closed.

Source of event

Microsoft-Windows-TerminalServices- LocalSession (2001) — RDP category.

Possible causes

• User closes the RDP window
• Network loss
• Administrative Logout

Verifications to be carried out

1. Identify the user and Session ID
2. Search for a reconnexion 25

Useful orders.

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object Id -eq 24 | Select-Object -First 20

To be retained.

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.