Skip to content

Instantly share code, notes, and snippets.

@drakevonduck

drakevonduck/rdp_log_investigate.ps1

Forked from Purp1eW0lf/rdp_log_investigate.ps1
Created April 6, 2023 22:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save drakevonduck/f54b2e6892d3d0bed0443331b4a61086 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save drakevonduck/f54b2e6892d3d0bed0443331b4a61086 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
rdp_log_investigate.ps1
get-winevent -logname "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" |
? id -match 1149 |
sort Time* -descending |
fl time*, message
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment