Windows Forensic Handbook

👋Welcome
Artifacts by Type
Artifacts by Activity

Powered by GitBook

On this page

Artifacts by Type

📅Event Log Artifacts

TerminalServices-LocalSessionManager

EventID 21: Session logon succeeded EventID 24: Session has been disconnected

Last updated 1 year ago