I have a site that exclusively uses Citrix to connect to a Windows accounting server. However, the Event log shows RDP connections with Event ID 1149. Those events show real users' names and source IPs. The concern is people are RDPing into the Citrix box vs. using the Citrix client. Is Citrix just making the RDP connections behinds the scenes from the ICA client?
as stated by Olivier MARCHETTA citrix don't use the RDP protocol for connection.
But the Citrix ICA protocol use the underlaying terninalservices like the RDP protocol.
So RDP and ICA may trigger the same events.
... and often (application-)administrators use RDP to configure / Check the server.
With citrix installed a normal user is not allowed to use RDP to connect by default. non-admin-user must be member of a special group to be able to use RDP.
Dirk Kotte
"no longer relevant" ... why? The answers from both SEs are relevant.
But the Citrix ICA protocol use the underlaying terninalservices like the RDP protocol.
So RDP and ICA may trigger the same events.
... and often (application-)administrato
With citrix installed a normal user is not allowed to use RDP to connect by default. non-admin-user must be member of a special group to be able to use RDP.