Evidence of Network Activity

Tracing Registry KeysEventID 1024: RDP ClientActiveX is trying to connect to the serverEventID 21: Session logon succeededEventID 24: Session has been disconnectedEventID 1149: User Authentication Succeeded

Last updated