EVT-0063
MEDIUM
RDP Event logs tracking 4624 / 4625
Event ID 4624 is generated in the Windows Security Log when a successful logon occurs on a local computer. This event is generated on the computer that was accessed, …
cat rdp-event-logs-tracking-4624-4625.md