How to check RDP access to the server

You're trying to quantify each user's RDP logons and source addresses, then determine whether files were copied to a local computer. Because this is Server 2019 with no prior auditing configuration, the Security log is the main historical source, but it only contains events still retained. In Event Viewer, filter Windows Logs > Security for 4624, then open events where Logon Type is 10. Match TargetUserName and record IpAddress; export matching events before log rollover, or query them with Get-WinEvent using Security as LogName and 4624 as Id. Use the resulting rows to count the user's successful remote-interactive logons. Those records prove successful logons, not clipboard contents or a completed file transfer. If no endpoint or file auditing existed, you cannot reconstruct that reliably afterward. For prevention, enable the Remote Desktop Session Host policy “Do not allow Clipboard redirection,” and define Security-log retention and centralized collection before the next investigation.