Log analytics on prem RDS query for current logged on users

[itskvad]

I currently have the log analytics agent installed on our on prem servers (RDS farm).

I was hoping I could create a query that would display - user and server logged on to. Logged on since what time and if the session is disconnected or active.

WVD has the following

// Session duration

// Lists users by session duration in the last 24 hours.

// The "State" provides information on the connection stage of an actitivity.

// The delta between "Connected" and "Completed" provides the connection time for a specific connection.

WVDConnections

| where TimeGenerated > ago(24h)

| where State == "Connected" 

| project CorrelationId , UserName, ConnectionType , StartTime=TimeGenerated 

| join (WVDConnections 

    | where State == "Completed" 

    | project EndTime=TimeGenerated, CorrelationId) 

    on CorrelationId 

| project Duration = EndTime - StartTime, ConnectionType, UserName 

| sort by Duration desc

Is there something similar for RDS on prem? Where would be the best place to start looking?

Thanks

[#2]

Hi,
Please see if http://woshub.com/rdp-connection-logs-forensics-windows/ and help you. Once you have identified the events you are interested in, you can collect them with Azure Monitor and use Kusto to visualize the data, the same way you do today.
Also, look for a performance counter that shows the number of connected users.