---
title: 'How to view RDP connection logs in Windows 2016, 2019 | Zomro'
description: 'In this article we will describe who connected to this or that server via RDP. This instruction can also be used on desktop versions of Windows'
image: 'https://dx86q6oq7ry0e.cloudfront.net/uploads/media/blog/a48@server-panel.net/2022/09/01/1661987063_1.png'
---

![opened image]()

  * [Zomro](https://zomro.com/)
  * [FAQ](https://zomro.com/blog/faq/)
  * How to view RDP connection logs in Windows Server 2016, 2019 



# How to view RDP connection logs in Windows Server 2016, 2019

30-10-2022

## How to find out who connected to a particular server via RDP. 

  
  
Using the logs written by the Windows OS, you can obtain information about which IP addresses and users connected to the virtual server, and when they did so.   
  
The instructions below can also be used on desktop versions of Windows.  
  
Let's consider some of the most common codes related to the server's startup and shutdown times.  
  
**1149****:** The presence of this code indicates a successful user authentication on the server. (Remote Desktop Services: User authentication succeeded)   
**21:** This code indicates a successful logon to the system, meaning the user has seen the desktop window. (Remote Desktop Services: Session logon succeeded)  
**24:** This event indicates a successful disconnection from RDP (Remote Desktop Services: Session has been disconnected)  
**25:** Indicates a reconnection to the RDP session. (Remote Desktop Services: Session reconnection succeeded)   
**23:** The user clicked Logoff and logged out of the system (Remote Desktop Services: Session logoff succeeded )  
**39:** The user manually disconnected from the RDP session (not just closed the RDP window). Or they were disconnected by another user or administrator.  
  


**How to view event data?**

Press **Win+R** and enter**eventvwr**

![How to view RDP connection logs in Windows Server 2016, 2019 - 1](https://dx86q6oq7ry0e.cloudfront.net/uploads/media/blog/a48@server-panel.net/2022/09/01/1661987063_1.png)

  
In the left panel, open "**Windows Logs = > System**"

![How to view RDP connection logs in Windows Server 2016, 2019 - 2](https://dx86q6oq7ry0e.cloudfront.net/uploads/media/blog/a48@server-panel.net/2022/09/01/1661987183_2.png)

  
In the **Event ID** column, we will see a list of events that occurred during the operation of Windows. The event log can be sorted by event ID.  
  
To filter the events we need, on the right side, select "**Filter Current Log** "

![How to view RDP connection logs in Windows Server 2016, 2019 - 3](https://dx86q6oq7ry0e.cloudfront.net/uploads/media/blog/a48@server-panel.net/2022/09/01/1661987525_3.png)

  
Now enter the desired events, separated by commas, **1149,39,25,24,23,21****** and click **OK**.  
  
![How to view RDP connection logs in Windows Server 2016, 2019 - 4](https://dx86q6oq7ry0e.cloudfront.net/uploads/media/blog/a48@server-panel.net/2022/10/01/1667168624_event.png)  


Now we can observe the event log with the shutdown of our VPS server.  
  
These events can be viewed in different sections. For example:  
  
**EventId 1149,****4624,4625** \- filter in Windows Logs => Security  
  
**EventId****25,24,21,39** \- filter in Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager -> Operational  
  
**EventId 23****-** Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager -> Operationa  
  
Now you can independently check who and when accessed your server via RDP.

Similar articles:

[How to create RAID 0 and RAID 1 on G9](https://zomro.com/blog/faq/244-kak-sozdat-raid-0-i-raid-1-na-g9) [Backups are not performed on the server with VestaCP](https://zomro.com/blog/faq/370-backups-are-not-performed-on-the-server-with-vestacp) [Configuring backups in the ISPmanager panel](https://zomro.com/blog/faq/205-nastrojka-bekapov-v-paneli-ispmanager) [Create an FTP user in Hestia CP and ISPmanager](https://zomro.com/blog/faq/686-create-an-ftp-user-in-hestia-cp-and-isp-manager) [How to create a Telegram bot for monitoring remote hosts](https://zomro.com/blog/faq/316-kak-sozdat-telegram-bota-dlja-monitoringa-udalennyh-hostov)

[ Premium Cloud VPS from €7.95/mon ](/vps)