PowerShell RDP Log Analysis | Event ID 4624 Security Log Guide

🖥️ PowerShell RDP Log Analysis Guide

Analyze Windows Security Logs and filter RDP (Logon Type 10) sessions using Event ID 4624.

🚀 PowerShell Command Overview

This script analyzes Windows Security Logs and extracts RDP (Remote Desktop) login activity from the last 30 days.

$StartDate = (Get-Date).AddDays(-30); Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartDate} -ErrorAction SilentlyContinue | ForEach-Object { $xml=$_.ToXml(); $data=@{}; foreach($d in $xml.Event.EventData.Data){ $data[$d.Name]=$d.'#text' }; if($data['LogonType'] -eq '10'){ [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; TimeCreated=$_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss'); TargetUserName=$data['TargetUserName']; TargetDomainName=$data['TargetDomainName']; IpAddress=$data['IpAddress']; WorkstationName=$data['WorkstationName']; LogonProcessName=$data['LogonProcessName']; AuthenticationPkg=$data['AuthenticationPackageName']; EventID=$_.Id } } } | Sort-Object TimeCreated

This command filters only successful RDP logins and helps you analyze user and IP-based connection history.

📌 What Does This Script Do?

Scans last 30 days of Security logs
Extracts Event ID 4624 (successful logins)
Parses XML event data
Filters Logon Type 10 (RDP sessions)
Extracts username, domain, and IP details
Sorts results by time

📌 Output Fields Explained

Field	Description
ComputerName	Machine where log was recorded
TimeCreated	Login timestamp
TargetUserName	User account name
TargetDomainName	Domain information
IpAddress	Source IP address
WorkstationName	Client machine name
LogonProcessName	Authentication process
AuthenticationPkg	Authentication package used
EventID	Event ID (4624)

🔒 Security Notice

This script should only be used on systems you are authorized to monitor. Unauthorized log analysis may be illegal.

📝 Conclusion

PowerShell provides a powerful way to analyze Windows Security Logs and track RDP login activity. Using Event ID 4624 and Logon Type 10 filters, you can easily monitor remote access sessions.