🔍
Windows Forensic Handbook
Search
Ctrl + K
TerminalServices-LocalSessionManager
EventID 21: Session logon succeeded
EventID 24: Session has been disconnected
Last updated
8 months ago