Forum Discussion
How to check RDP access to the server
Hello,
I have a virtual machine running Windows Server 2019 Datacenter with Active Directory, and all users access it via RDP. No specific access configurations have been set up; I wanted to know if it is possible to check how many times a specific user has connected and from which IP address—is that possible? Also, I wanted to ask if it is possible to determine whether a specific user copied files to their local PC using copy/paste during a session.
Thank you
1 Reply
Yes, both are possible to some extent, but the level of detail depends on your audit configuration.
For RDP connections, Windows logs successful and failed logons in the Security event log. You can review events such as:
- 4624 – Successful logon (Logon Type 10 indicates Remote Desktop).
- 4625 – Failed logon attempts.
- 4634 – Logoff.
- 4778 and 4779 – RDP session reconnect and disconnect.
These events include the username, timestamp, and, in most cases, the source IP address, allowing you to determine how many times a user connected and from where.
Regarding copying files to a local PC via RDP copy/paste, Windows does not log clipboard activity or file transfers by default. If clipboard or drive redirection was enabled and no auditing or endpoint monitoring solution (such as Microsoft Defender for Endpoint, Sysmon, or a third-party EDR) was in place before the incident, it is generally not possible to prove that files were copied.
If preventing data exfiltration is a concern, consider disabling clipboard, drive, and device redirection through Group Policy for RDP sessions, and enable advanced auditing or endpoint monitoring for future investigations.
