# TerminalServices-LocalSessionManager

- [EventID 21: Session logon succeeded](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-21.md)
- [EventID 24: Session has been disconnected](/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-24.md)