Last updated 7 months ago
Microsoft-Windows-TerminalServices-RDPClient/Operational
This event is logged by default
Can be used to hunt for connections to other machines over RDP