Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I connect to my work PC via VPN/RDP and I would like to find a log file on my work PC that would include some information on when I used it last, from where my connection originated and how long it lasted. Where in Windows 7 would I look to find that out?

share|improve this question

5 Answers 5

up vote 15 down vote accepted

If you look at the event viewer as the administrator there are server logs but not for login/logout as far as I know.

Please check the Event Viewer tree on the left side under "Applications and Services Logs -> Windows -> TerminalServices-*" where * is all of the logs there. I think you are most interested in the TerminalService-LocalSessionManager Operational log.

There is also a "RemoteDesktopServices-RemoteDesktopSessionManager" node in the event viewer tree on the left side under "Applications and Services Logs -> Windows". Only the Administrator role is allowed to view the file I believe. Please confirm and let me know if this addresses your use case.

Maybe try this for logging login/logout as well: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/aptopnode.mspx?mfr=true

share|improve this answer
Actually either TerminalService-LocalSessionManager Operational or TerminalService-RemoteConnectionManager Operational work for me. I can see the username and the dhcp IP from there. Thanks. –  Darius Apr 5 '12 at 23:26

I can't tell you how to check from your work machine when you established a VPN as presumably it isn't the VPN server (?). However, if you're using Remote Desktop Connection to control that work PC you may be able to pull the logon / logoff times from the Event Viewer.

Look in the Security logs for those. RDP logons are an Event ID 4624 but just searching for 4624 won't work. Within the event you need the Logon Type value to be "10" and the SecurityID value to be yours. Not sure how to filter those...

share|improve this answer
This works as well but the log that I can get from Jarod's answer are easier to digest. –  Darius Apr 5 '12 at 23:44

In your case you need to review TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs from you computer. You can also check an excellent third party tool called Terminal Services Logs. It will generate you all sort of reports from logs and will save you a bunch of time if you want to get all of details about RDP connections and other stuff.

share|improve this answer

Look under 'Application and Services Logs' > 'Microsoft' > 'Windows' > 'TerminalServices-ClientActiveXCore' > 'Microsoft-Windows-TerminalServices-RDPClient/Operation' ,

This log will have events which contain the server name which the end user attempted to connect RDP into.

share|improve this answer

I found the information in the Event Viewer under Windows Logs/Security you will see under task category logon and logoff events.

share|improve this answer
Not entirely sure where you were looking but that area does not provide the information I was asking for. –  Darius Jul 17 '14 at 19:39
RDP can also reconnect to an existing session, in which case there won't be a logon event. –  Ben Voigt Jul 17 '14 at 20:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.