Forum Discussion
How to check RDP access to the server
Hello,
I have a virtual machine running Windows Server 2019 Datacenter with Active Directory, and all users access it via RDP. No specific access configurations have been set up; I wanted to know if it is possible to check how many times a specific user has connected and from which IP address—is that possible? Also, I wanted to ask if it is possible to determine whether a specific user copied files to their local PC using copy/paste during a session.
Thank you
2 Replies
You're trying to quantify each user's RDP logons and source addresses, then determine whether files were copied to a local computer. Because this is Server 2019 with no prior auditing configuration, the Security log is the main historical source, but it only contains events still retained. In Event Viewer, filter Windows Logs > Security for 4624, then open events where Logon Type is 10. Match TargetUserName and record IpAddress; export matching events before log rollover, or query them with Get-WinEvent using Security as LogName and 4624 as Id. Use the resulting rows to count the user's successful remote-interactive logons. Those records prove successful logons, not clipboard contents or a completed file transfer. If no endpoint or file auditing existed, you cannot reconstruct that reliably afterward. For prevention, enable the Remote Desktop Session Host policy “Do not allow Clipboard redirection,” and define Security-log retention and centralized collection before the next investigation.
Yes, both are possible to some extent, but the level of detail depends on your audit configuration.
For RDP connections, Windows logs successful and failed logons in the Security event log. You can review events such as:
- 4624 – Successful logon (Logon Type 10 indicates Remote Desktop).
- 4625 – Failed logon attempts.
- 4634 – Logoff.
- 4778 and 4779 – RDP session reconnect and disconnect.
These events include the username, timestamp, and, in most cases, the source IP address, allowing you to determine how many times a user connected and from where.
Regarding copying files to a local PC via RDP copy/paste, Windows does not log clipboard activity or file transfers by default. If clipboard or drive redirection was enabled and no auditing or endpoint monitoring solution (such as Microsoft Defender for Endpoint, Sysmon, or a third-party EDR) was in place before the incident, it is generally not possible to prove that files were copied.
If preventing data exfiltration is a concern, consider disabling clipboard, drive, and device redirection through Group Policy for RDP sessions, and enable advanced auditing or endpoint monitoring for future investigations.
