Remote Login

I would like to know if there is a way to tell when user log into a computer by remote access. Is this in the event log somewhere? if it is what event id would it be? If it is elsewhere please advise.
Who is Participating?
gorhonConnect With a Mentor Commented:
netstat -an | find "3389"

if you see "establish" yes connect you.


goto task manager and users tab, see computer name? if you stranger name and more one, yes this is rdp.

or close rdp. forget any.
Have you checked the Security Log?
devinngoAuthor Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.