Remote Desktop - Session Logs - Windows
Log In or Register to download the BES file, and more.

0 Votes

Versioning - This is the latest version.

1Remote Desktop - Session Logs - Windows5/13/2016 8:21:45 AM
2Remote Desktop - Session Logs - Windows2/24/2017 2:01:40 PM


Provides information about previous remote desktop sessions on the system.

NOTE: Due to issues with how BigFix parses the event log: this will NOT return results for users resuming their RDP sessions. This will only return results for users starting brand new user sessions over RDP.

For general information or to report issues with C3 Remote Control content please visit GitHub here:

Property Details

TitleRemote Desktop - Session Logs - Windows
Added by on 2/24/2017 2:01:40 PM
Last Modified by on 2/24/2017 2:01:40 PM
Counters 1998 Views / 40 Downloads
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 0 ratings. ** Log In or Register to add your rating.


Remote Desktop - Incoming Sessions - Windows
Period 6 hours
  * Results in a true/false
Show indented relevance
(preceding text of first "%0d%0a" of following text of first "User: " of description of it | "Unknown", time generated of it, (if (it = 21) then ("New Session") else ("Resumed Session")) of (event id of it), following text of last ": " of description of it) of records ((integers in(item 0 of it + item 1 of it - 1,maximum of (item 0 of it + item 1 of it - 2000;item 1 of it))) of (record count of it, oldest record number of it)) whose (exists description of it and (event id of it = 21 or event id of it = 25) and description of it does not contain "LOCAL") of event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"


isWindows (Relevance 1172)
Used in 1127 fixlets and 529 analyses   * Results in a true/false
Show indented relevance
windows of operating system


Social Media:
Share this page on Yammer