Reset Windows Password: Remote Desktop event viewer
When using the Terminal Server Client (also known as Remote Desktop Connection) in Windows, various events related to the client are saved and can be viewed later using the Event Viewer. To view events related to the Terminal Server Client, open the Event Viewer, navigate to the "Applications and Services Logs" section, expand the "Microsoft" folder and select the "TerminalServices-ClientActiveXCore" log.
The Event Viewer is a tool in Windows that allows users to view and manage system and application logs. However, it can only be accessed after logging in to the account. Another issue is that events related to the Remote Desktop are scattered across different logs and not restricted to the "TerminalServices-ClientActiveXCore" log.
This program feature overcomes both problems by gathering as many events related to RDP connections as possible, extracting additional data from the "TerminalServices-RemoteConnectionManager," "RemoteDesktopServices-RdpCoreTS," "TerminalServices-LocalSessionManager," "System," and "Security" logs.
Selecting Windows directory
To do this, specify the directory where Windows is located.
Remote desktop events viewer
Viewing the found RDP logs. You can use the context menu to save the list as HTML report.
Please note that it may take some time to enumerate and analyze all log items.