What Is It?
The “Windows Terminal Server – Remote Connection Manager Log” records events associated with the Remote Connection Manager, which is part of the “Remote Desktop Services” (RDS) service. RDS was previously called “Terminal Services”.
The log contains information about Windows Remote Desktop connections, which are Inbound Logon Artifacts. Note that there are several other logs that contain information about RDS activity and remote logons.
What Does It Contain?
This log contains audit and debug information associated with the “Remote Connection Manager”. The Remote Connection Manager is responsible for managing the listening RDP network port (TCP port 3389) and interacting with other parts of Windows, such as “winlogon” for authentication.
The log contains several types of events, such as:
- When the service starts up
- When connections are made to it
A list of events is given below.
Relevance to DFIR?
This event log is useful when investigating inbound Windows RDP remote logins. RDP can be used by attackers to remotely control a system once they have account credentials.
Note that if the attackers used remote access software other than WIndows RDP, then this log will not have entries for those logins.
Storage Details
The event log file can be found at:
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx
It can be disabled by setting the “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational/Enabled” key to “0”.
Specific Events
The notable event types in there include:
- Event ID 261 – Connection
- Event ID 1149 – “User Authentication Succeeded”
Note that nothing in this log will indicate a failed logon.
Cyber Triage Status
Cyber Triage collects this log file and parses it to make Inbound Logon sessions.
Sources
- https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/
- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation
- http://blog.kiddaland.net/2015/02/remote-desktop-connections-terminal.html
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc727363(v=ws.10)
