====== Server Remote Desktop Logs ======

Unlike Unix, Windows logs are binary files, so you can not simply search them. And, sometimes it is difficult to find the entries you want, but it is not impossible.

You will need to find the correct submenu in the //Events Viewer//, then look through the entries there. Logs can be filtered, and exported in various formats.

===== Find Terminal Services Log =====

Open Control Panel, go to Event Viewer, then find 

Applications and Services Logs | Microsoft | Windows | TerminalServices-LocalSessionManager | Operational

<code>
   Applications and Services Logs
      Microsoft
         Windows
            TerminalServices-LocalSessionManager
               Operational
</code>

===== Filter to get what you want =====

  * On right, click on Filter Current Log
  * Set Logged to date range, or leave as all
  * Set Event ID to 25 (that is the event ID for a login)
  * Click "Ok"

===== Export the information =====

You have several options to export the data you filter

  * On right, click Save Filters Log File As..
  * Save it as an XML or a TXT (tab delimited)
  * Open Microsoft Excel
  * Open the file.
  * clean up unnecessary columns
  * Save as Excel workbook

===== Links =====

  * [[https://social.technet.microsoft.com/Forums/ie/en-US/cb1c904f-b542-4102-a8cb-e0c464249280/is-there-a-log-file-for-rdp-connections]]