Track IP Adress login RDP when shutdown happen

Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has access to this user.

How can I find out from what IP the admin user was login when this command was requested (What event ID I'm need to lookup)?

Thanks.

Solution 1:

If I understand correctly, your question is "How can I find the IP from which a RDP connection was established?".

You can take a look at the following log, in the event viewer: Application and Services Logs -> Microsoft -> Windows -> Terminal Services-LocalSessionManager -> Operational, event ID 21 in this log should be what you are looking for.

However there are multiple ways of shutting down Windows... take a look at System event log, Event ID 1074 in the User32 source, it should give you more details about who/what initiated the shutdown.