Monitor Win10 RDP logins via a log file

I know there is the win10 event application to view recent logins, but is there a login history log file I can monitor or retrieve on Windows 10?


Yes, It is possible, But you need to advanced level forensic and OS knowledge to retrieve details. Best thing to do is enable login auditing and send all details to centralized log server like syslog or SIEM. Because forensic data may not be complete in some-times.

In addition to that you can use RDP management and monitoring tool such as rdpsoft. It will provide complete and clear data about all rdp connectivity. But this product is not effective one single computer. Network based RDP monitoring can achieve by remote monitoring and managing tool.

Even in network you can use firewall to identify user connection establishment and disconnection.