EventID 24: Session has been disconnected

This event, logged to the Microsoft-Windows-TerminalServices-LocalSessionManager/Operational channel, is logged when an RDP connection is terminated.

This event is logged on the destination endpoint.

Analysis Value

pageUsernamepageEvidence of Network ActivitypageSource Identification

Operating System Availability

Major VersionSupportMajor VersionSupport

Windows 11

✅

Server 2019

✅

Windows 10

✅

Server 2016

✅

Windows 8

✅

Server 2012

✅

Windows 7

✅

Server 2008

✅

Windows Vista

✅

Server 2003

❌

Windows XP

❌

Artifact Location(s)

  • %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Artifact Interpretation

FieldInterpretationReference

UserData/EventXML/User

This field logs only the username and domain that the RDP connection had.

Username

UserData/EventXML/Address

This field provides the source IP address of an RDP session.

Source Identification

UserData/EventXML/SessionID

This field provides the Session ID, which can be used to correlate between other events in the same log provider.

System/Correlation ActivityID

Provides the ActivityID for the RDP session.

Analysis Tips

Correlation by ActivityID

This event logs an ActivityID, available in the XML path System/Correlation ActivityID. This may be used to correlate activity between other events logged that are related to this activity, such as:

EventID 1149: User Authentication Succeeded

RDP Activity Timeline

Together with EventID 21: Session logon succeeded, by correlating the SessionID field of both events, one can determine the start and end time of an RDP session.

Example

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5d896912-022d-40aa-a3a8-4fa5515c76d7}" /> 
  <EventID>24</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x1000000000000000</Keywords> 
  <TimeCreated SystemTime="2023-07-12T12:46:43.1684648Z" /> 
  <EventRecordID>1544</EventRecordID> 
  <Correlation ActivityID="{f4207ac4-a73b-4efa-b345-178e7e530000}" /> 
  <Execution ProcessID="1440" ThreadID="7996" /> 
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel> 
  <Computer>HLPC01</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <User>HLPC01\john.doe</User> 
  <SessionID>4</SessionID> 
  <Address>192.168.180.57</Address> 
  </EventXML>
  </UserData>
  </Event>

This example was produced on Windows 10, Version 10.0.19044 Build 19044</

Last updated