Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I specifically asked someone not to remotely access a computer running Win 7 Pro 32bit.

Now I see on the computer that Remote Access is fully set up to their laptop.

Is there a log or record somewhere in Win 7 of the times, dates and/or files they have remotely accessed via their laptop? I would like some proof before I confront them.

share|improve this question

I found this very helpful page about Windows 7 event log

As well as events 4624 (logon) and 4634 (logoff), I believe 4778 (session connect) and 4779 (session disconnect) are useful for monitoring remote desktop sessions.

share|improve this answer

It's not really a log file and I only had a WinXP system to verify it, but I assume the behavior hasn't changed that much: The remote desktop application (mstsc.exe) on the local machine remembers the hostname/ip address of the last few remote hosts that one connected to.
Just start it and then you should be able to see entries in the drop down list.

Using this data, there is no way to tell when the login happened and it can therefore only give an indication.

share|improve this answer

The short answer, not by default.

However if the firewall is on and logging on the firewall is enabled on the host machine, you can see logon attempts from remote machines in the Event Viewer under the Security Log. They normally have an Event ID of 10 and shows the machine name that connected at the time.

share|improve this answer
The firewall does NOT have to be turned on to enable logging via the security log and event viewer -- you just have to edit the policies to turn on logging of remote access. – David W. Fenton Feb 5 '11 at 1:56
@David Interesting. We were never able to get it to work without the firewall. – BinaryMisfit Feb 5 '11 at 6:19
Thanks a lot guys, very useful info. – Mel Feb 5 '11 at 8:14
Are you going to Control Panel | Administrative Tools | Local Security Policies | Local Policies | Audit Policy? – David W. Fenton Feb 6 '11 at 23:45
@David. Yes. We spent about a week trying different things. Even Microsoft couldn't get it working. – BinaryMisfit Feb 7 '11 at 6:36

In Event Manager in Windows 7 all the logs regarding attempted RDP connections made from the machine are under Windows Logs > Application and Service Logs > Microsoft > Windows > TerminalServices-ClientActiveXCore > Microsoft-Windows-TerminalServices-RDPClient/Operational

Will show you addresses attempted and what happened with the connection

share|improve this answer

Just had something like this happen to me at work and I found the information in the security section of the event log. Showed a networked log-on from a remote user and included their windows logon id, IP, type of log-on (networked, local, etc), and domain name.

share|improve this answer
Could you provide a step-by-step or a screenshot? This would be a lot more helpful. – user 99572 is fine Mar 13 '13 at 8:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.