0

I recently discovered that since some days, someone often logs off my RDP session to our jump admin server when I have disconnected my session (which then terminates any long-running task I may have running on that machine).

Now I want to know who it is without asking every possible person. Is there any relevant log information somewhere which may reveal who has logged off my RDP session?

John Ranger
  • 123
  • 5
  • Check the event logs under: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational – Greg Askew Dec 31 '21 at 00:59
  • Hmm - I had just now a look there and I only see session disconnects and reconnects of my user account there in the relevant time frame - but nothing similar to someone logging my session off. E.G. at 21:44:56 it says session disconnected. At 23:18:43 it says session reconnected for my user - but the session at 23:18:43 was a completely fresh session (no open apps, nothing) where as I had left the session which disconnected at 21:44:56 was with diverse apps open. I see absolutely nothing relevant in the few log entries between these two points in time. Any other idea? – John Ranger Dec 31 '21 at 09:18

0 Answers0