if you want to know who and from which station a user logs on via remote desktop you can use the following powershell commands.
本地登录：
Get-WinEvent -ProviderName Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 21}|select-object Timecreated,Message|fl *
远程登录(显示来源IP地址):
Get-WinEvent -ProviderName Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 25}|select-object Timecreated,Message|fl *
原文:
https://michlstechblog.info/blog/windows-get-a-list-of-remote-desktop-logons/#more-6302
[
本帖最后由 linda 于 2019-9-19 18:35 编辑 ]
