Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I connect to my work PC via VPN/RDP and I would like to find a log file on my work PC that would include some information on when I used it last, from where my connection originated and how long it lasted. Where in Windows 7 would I look to find that out?

share|improve this question
Shouldn't this be on serverfault? – Pacerier Jun 26 '15 at 7:38
up vote 25 down vote accepted

If you look at the event viewer as the administrator there are server logs but not for login/logout as far as I know.

Please check the Event Viewer tree on the left side under "Applications and Services Logs -> Windows -> TerminalServices-*" where * is all of the logs there. I think you are most interested in the TerminalService-LocalSessionManager Operational log.

There is also a "RemoteDesktopServices-RemoteDesktopSessionManager" node in the event viewer tree on the left side under "Applications and Services Logs -> Windows". Only the Administrator role is allowed to view the file I believe. Please confirm and let me know if this addresses your use case.

Maybe try this for logging login/logout as well:

share|improve this answer
Actually either TerminalService-LocalSessionManager Operational or TerminalService-RemoteConnectionManager Operational work for me. I can see the username and the dhcp IP from there. Thanks. – Darius Apr 5 '12 at 23:26

I can't tell you how to check from your work machine when you established a VPN as presumably it isn't the VPN server (?). However, if you're using Remote Desktop Connection to control that work PC you may be able to pull the logon / logoff times from the Event Viewer.

Look in the Security logs for those. RDP logons are an Event ID 4624 but just searching for 4624 won't work. Within the event you need the Logon Type value to be "10" and the SecurityID value to be yours. Not sure how to filter those...

share|improve this answer
This works as well but the log that I can get from Jarod's answer are easier to digest. – Darius Apr 5 '12 at 23:44

Look under 'Application and Services Logs' > 'Microsoft' > 'Windows' > 'TerminalServices-ClientActiveXCore' > 'Microsoft-Windows-TerminalServices-RDPClient/Operation' ,

This log will have events which contain the server name which the end user attempted to connect RDP into.

share|improve this answer

I found the information in the Event Viewer under Windows Logs/Security you will see under task category logon and logoff events.

share|improve this answer
Not entirely sure where you were looking but that area does not provide the information I was asking for. – Darius Jul 17 '14 at 19:39
RDP can also reconnect to an existing session, in which case there won't be a logon event. – Ben Voigt Jul 17 '14 at 20:37
@BenVoigt, The logon logoff might also not be from RDP right? – Pacerier Jun 26 '15 at 7:44

In your case, you need to review TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs from your computer.

You can also check an excellent third party tool called SysKit, formerly Terminal Services Log. It will generate you all sort of reports from logs and will save you a bunch of time if you want to get all of the details about RDP connections and other stuff.

Please note: I am affiliated with Acceleratio, the makers of the tool mentioned above, so I might be a little bit biased here.

share|improve this answer
the syskit price is a little steep :( – sdjuan Jan 20 at 17:21
If you mentioned a tool that was open source as well in your answer I would like it even more :) – Darius Jul 4 at 6:49

Use the command quser to show sessions.

Then you will see something like ID 1 or 2 or 4. Then type Logoff 4 to log off that session.

You can also type query session or qwinsta (both are the same thing) Show's who's on and what port is listening etc.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .