Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

RDP LocalSessionManager/Operational log: session logon (21), logoff (23), disconnect (24) and reconnect (25), with user name and source address.

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-TerminalServices-LocalSessionManager/Operational channel tracks the life of sessions on the machine receiving the connection: who signed in, from which address, when the session was disconnected and when it was reopened. It is useful on an RDS server as well as on a Pro workstation that accepts Remote Desktop (RDP).

What it contains

  • 21: successful session logon (user, session ID, source address).
  • 22: shell start.
  • 23: session logoff.
  • 24: session disconnected without logoff (the RDP window was closed).
  • 25: reconnection to an existing session.
  • The source address is LOCAL for a console session.

Risks and best practices

  • It proves that a session was opened, not that an attempt was made: authentication failures are in the Security log (4625), and successful network authentication is in RemoteConnectionManager (1149).
  • It holds user names and IP addresses: export it before clearing it on an exposed server, in case of an investigation.
  • A 24 followed by a 25 is normal (network drop then reconnect); a run of 24s without 25s means sessions are left running in the background.

Useful commands

Fenêtre de terminal
# Last 50 events of the channel
Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' -MaxEvents 50


# Logons, logoffs, disconnects and reconnects over the last 7 days
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'; Id=21,23,24,25; StartTime=(Get-Date).AddDays(-7)} |
    Select-Object TimeCreated, Id, Message


# Sessions currently open
quser

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy; wevtutil gl shows the configuration and wevtutil epl exports the log.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, TerminalServices-LocalSessionManager, Operational. To reconstruct an incident, line up the 21 and 25 events here with 1149 in RemoteConnectionManager and with the type 10 logon events (4624) in the Security log.

Report a mistake