> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.tradingvps.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How to Check RDP Login Logs on Your Windows Server

| If you’re worried that someone other than you may have logged into your server recently, check out this guide on how to find the list of successful logins into your server.


### Why Check RDP Login Logs?
### 
* Monitoring RDP login logs helps you:
* Identify unauthorized login attempts
* Detect brute-force attacks
* Verify if a specific user logged in successfully
* Track failed login attempts
* Strengthen your server’s security

### How to check for Remote Desktop Protocol (RDP) logins

1. First off, click the search bar at the bottom of the screen, next to the Windows icon. From there, type in “Event Viewer,” then select the ***Event Viewer*** to open the application.


![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1hx0l8w.png)

2. Now we’ve got to find the correct log file. Click on ***Action*** in the top left of the application, then hit ***Open Saved Log.***


![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_gvhcvr.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_bl8cc0.png)

3. Here’s the toughest part: we’ve got to find the proper log file that’s related to remote desktop connections. Get ready, as the name is pretty long – it’s called ***Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.*** You can find it in the following directory: ***This PC > Local Disk (C:) > Windows > System32 > winevt > logs.***

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_f8sl84.png)

* Double click

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1kt2r45.png)

* Double click

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_th132f.png)

* Double click

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_egtnxl.png)

* Double click

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1gmfgq6.png)

* Double click

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1kbxs2b.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_xd7p8o.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1ufm6gh.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_ytyjjo.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_4rk1zl.png)

3. Next, we need to filter the log to see when any successful logins took place. Click on ***Filter Current Log*** on the right, and then type ***25*** into the space depicted in the image below. Then click ***OK***.

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_5bwg8f.png)

* Now, you can see when your server was accessed, as well as the IP address from which it happened. If you’re looking for a specific incident, all you’ve got to do is find the event in the ***Date and Time*** column, and click on it to view the details of the login!
### How to save the results for future use.

* It’s worth noting that you can save this log for future reference. Just right-click ***Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational*** under ***Saved Logs*** on the left-hand side of the program, then select ***Create Custom View***. Type ***25*** in the same field as before, then hit ***OK***.

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_1676sbj.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_lzjz5s.png)

* Finally, you can name it something like ***RDP Logins***, and it’ll be readily available in the ***Custom Views*** folder, also on the left-hand side. Now, you can easily check remote logins whenever you want!

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_6gedvm.png)

![](https://storage.crisp.chat/users/helpdesk/website/-/5/4/1/3/5413a8a0321f3000/image_37g3pv.png)