Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Remote Desktop > Remote Desktop events
Analyze events related to the Remote Desktop activity
20.09.2023
Windows Password Recovery v15.3.0
Windows Credentials Explorer
05.06.2023
Reset Windows Password v13.1
Forensic tools to analyze Remote Desktop activity in Windows
10.05.2023
Wireless Password Recovery v6.8.1
New templates to seach for default passwords of some broadband WiFi routers
24.04.2023
Reset Windows Password v13.0
Full support for Windows 11, duplicate file finder, checksum calculator and some new tools

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: Remote Desktop event viewer


When using the Terminal Server Client (also known as Remote Desktop Connection) in Windows, various events related to the client are saved and can be viewed later using the Event Viewer. To view events related to the Terminal Server Client, open the Event Viewer, navigate to the "Applications and Services Logs" section, expand the "Microsoft" folder and select the "TerminalServices-ClientActiveXCore" log.

The Event Viewer is a tool in Windows that allows users to view and manage system and application logs. However, it can only be accessed after logging in to the account. Another issue is that events related to the Remote Desktop are scattered across different logs and not restricted to the "TerminalServices-ClientActiveXCore" log. 

This program feature overcomes both problems by gathering as many events related to RDP connections as possible, extracting additional data from the "TerminalServices-RemoteConnectionManager," "RemoteDesktopServices-RdpCoreTS," "TerminalServices-LocalSessionManager," "System," and "Security" logs.

 

Selecting Windows directory

Remote Desktop events location

To do this, specify the directory where Windows is located.


 

Remote desktop events viewer

Remote Desktop event viewer

Viewing the found RDP logs. You can use the context menu to save the list as HTML report.
 

Please note that it may take some time to enumerate and analyze all log items.