🔍
Windows Forensic Handbook
Ctrl
K
Copy
Artifacts by Type
📅
Event Log Artifacts
TerminalServices-LocalSessionManager
EventID 21: Session logon succeeded
EventID 24: Session has been disconnected
Last updated
1 year ago