Logout RDP Session Expand / Collapse
Author
Message
Posted 6/18/2014 10:03:20 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/18/2014 9:03:52 AM
Posts: 1, Visits: 0
Dear All,
i need to collect the event id for login and logout activity in Remote Desktop.

Regarding the login there isn't problem. 4624 is the event id that i need.

The problem is regarding the logoff.
I did some tests and notice that:
-sometimes I receive two logs: 4634 and 4647.
-sometimes I receive only 4647 id
-sometimes I receive 4634.
I don't understand the reason of this

Can you tell me why the what is the event that i need to collect for logoff rdp activity?

thanks a lot
sam


Post #1347
Posted 8/4/2014 6:52:17 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Event ID 4647 is supposed to indicate the logoff of an interactive session including Remote Interactive (RDP). This event can be correlated to the specific logon event using the logon id property.
Post #1362
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:42pm