Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx

RDP RemoteConnectionManager/Operational log: event 1149 (network authentication succeeded, before logon) and 261 (connection received).

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational channel records Remote Desktop connections arriving at the RDP listener, before a session is created. It is the log to check to see who knocked on the door, including when no session was opened afterwards.

What it contains

  • 1149: “User authentication succeeded”, with the user name, domain and source IP address. It is written as soon as the credentials are accepted at network level (NLA), so before Windows allows or refuses the logon.
  • 261: the RDP-Tcp listener received a connection.
  • Listener and configuration events, depending on the version.

Risks and best practices

  • A 1149 does not prove that a session was opened: a correct password is enough. Cross-check with event 21 in LocalSessionManager and the type 10 4624 in the Security log.
  • On a server exposed to the Internet, a burst of 1149 from unknown addresses points to successful brute force or stolen credentials; failures are logged as 4625 in the Security log.
  • The source IPs in this log are those of the client, or of the proxy (RD Gateway) that opened the connection.

Useful commands

Fenêtre de terminal
# 1149 over the last 7 days: who, from where, when
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; Id=1149; StartTime=(Get-Date).AddDays(-7)} |
    Select-Object TimeCreated, Message


# Last 50 events of the channel
Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' -MaxEvents 50

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy; wevtutil gl shows the configuration and wevtutil epl exports the log.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, TerminalServices-RemoteConnectionManager, Operational. Filter on 1149, then read the user, domain and address in the message and match the time with the session events in LocalSessionManager.

Report a mistake