Question

in microsoft-windows-remotedesktopservices-rdpcoretsoperational evtx what logs will you look for on the destination system for remote access:

Answer 1

To audit remote access on a destination system, look for key event IDs within Microsoft-Windows-RemoteDesktopServices-RdpCoreTS operational event logs that indicate successful connections, disconnections, and authentication events.

Step-by-step explanation:

When examining the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS operational event logs on a destination system for remote access activity, you will look for several event IDs that indicate different stages of remote connection process. These events include successful connections, disconnections, and reconnections among others.

Some of the key event IDs to look for are:

• Event ID 131 - Indicates a successful outbound connection from the source.
• Event ID 140 - Signals a successful inbound connection to the destination system.
• Event ID 1149 - Logs users who have been authenticated to use remote desktop on the target system.
• Event ID 23 - Reflects the termination of a graphics renderer, which often corresponds to a remote session ending.

These logs are essential for tracking and auditing remote access to a machine. They provide insights into the usage patterns and potential security breaches that may occur. The analysis of these logs will help in understanding the remote sessions and any related issues or activities.