Server Remote Desktop Logs

Unlike Unix, Windows logs are binary files, so you can not simply search them. And, sometimes it is difficult to find the entries you want, but it is not impossible.

You will need to find the correct submenu in the Events Viewer, then look through the entries there. Logs can be filtered, and exported in various formats.

Open Control Panel, go to Event Viewer, then find

Applications and Services Logs | Microsoft | Windows | TerminalServices-LocalSessionManager | Operational

   Applications and Services Logs
      Microsoft
         Windows
            TerminalServices-LocalSessionManager
               Operational

• On right, click on Filter Current Log
• Set Logged to date range, or leave as all
• Set Event ID to 25 (that is the event ID for a login)
• Click “Ok”

You have several options to export the data you filter

• On right, click Save Filters Log File As..
• Save it as an XML or a TXT (tab delimited)
• Open Microsoft Excel
• Open the file.
• clean up unnecessary columns
• Save as Excel workbook

• https://social.technet.microsoft.com/Forums/ie/en-US/cb1c904f-b542-4102-a8cb-e0c464249280/is-there-a-log-file-for-rdp-connections