Question

what ID's in microsoft windows terminal services-localsession manaager are useful in showing information on remote access to a system

Answer 1

IDs in Microsoft Windows Terminal Services (Remote Desktop Services), particularly Event IDs in Windows Event Viewer, provide information on remote access to a system such as successful or failed logins and session disconnections.

Step-by-step explanation:

Microsoft Windows Terminal Services, which is now known as Remote Desktop Services (RDS), uses various IDs for tracking and managing remote connections. The Local Session Manager (LSM) is an element within RDS that is responsible for managing local and remote session connections. One key set of IDs used by administrators to audit and monitor remote access to a system are the Event IDs within the Windows Event Viewer.

In the context of remote access to a system, certain Event IDs are particularly useful. For example:

• Event ID 4624 indicates a successful account logon.
• Event ID 4625 logs a failed account logon attempt.
• Event ID 4634 signifies an account was logged off.
• Event ID 4779 signifies a session has been disconnected from the local system.
• Event ID 4778 signifies a session reconnect to the local system.

By examining these event logs, administrators can determine when a user has remotely accessed a system, whether attempts have failed, and when they have disconnected or reconnected, providing valuable information for security and management purposes.