Windows DFIR · RDP

Turn scattered event IDs into one session story.

Choose what happened. Follow the evidence in time. Learn what each event proves—and what it does not.

Connection Authentication Session Disconnect Logoff

1 · Pick a story

What happened?

2 · Read left to right

Evidence timeline

A repeatable investigation

Build the trail, not a guess

01Anchor
Start with the host, time window, user, and suspected source.
02Assess authentication
Treat RCM 1149 as an authentication/connection-stage event whose semantics and timing vary by Windows version, NLA path, and configuration. Require Security 4624/4625 and LSM 21/22 evidence.
03Support session attribution
Events 21/22 support an RDP interpretation but do not unconditionally prove RDP. Require a non-LOCAL source field and corroborating events, and preserve the LSM Session ID.
04Follow lifecycle
Separate disconnect, reconnect, and formal logoff.
05Cross-check
Confirm the same story across channels and identifiers.

PowerShell: collect the core RDP events

$start = (Get-Date).AddDays(-7)

$rcmEvents = Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'
  ProviderName = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager'
  StartTime = $start
  Id = 1149
}

$lsmEvents = Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
  ProviderName = 'Microsoft-Windows-TerminalServices-LocalSessionManager'
  StartTime = $start
  Id = 21,22,23,24,25,39,40
}

$securityEvents = Get-WinEvent -FilterHashtable @{
  LogName = 'Security'
  ProviderName = 'Microsoft-Windows-Security-Auditing'
  StartTime = $start
  Id = 4624,4625,4634,4647,4778,4779
}

$events = @($rcmEvents; $lsmEvents; $securityEvents) |
  Sort-Object TimeCreated

$events | Select-Object TimeCreated,Id,ProviderName,LogName,RecordId,MachineName,Message |
  Format-List

# Optional durable copy for later analysis:
$events | Select-Object TimeCreated,Id,ProviderName,LogName,RecordId,MachineName,Message |
  Export-Clixml -Path '.\rdp-events.clixml'

Field reference

Event library

Keep yourself honest

Common interpretation traps

1149 is version- and path-sensitive

RemoteConnectionManager reports an authentication/connection-stage event. Its semantics and timing vary by Windows version, NLA path, and configuration; it does not alone establish successful credentials or RDP-service authentication.

Identifier namespaces differ

Security Logon ID and LSM Session ID are different identifier namespaces and must not be equated. Bridge them through user, source, time, and context.

LOCAL is field-specific

For the relevant LSM and Security-provider fields, LOCAL indicates console/local context; do not universalize it across providers.

Disconnect ≠ logoff

A disconnected session may continue running and later reconnect.

Event availability varies

Auditing, Windows version, NLA, and log retention affect what you can recover.

Sources and scope

This guide focuses on common target-host events on Windows Vista and later. Treat the sequences as investigation patterns, not guaranteed recipes; configuration and Windows version can change what is recorded. Security-event Logon IDs are only meaningful on the same computer and are only unique between reboots.