Last updated 1 year ago
Microsoft-Windows-TerminalServices-RDPClient/Operational
This event is logged by default
Can be used to hunt for connections to other machines over RDP