How to find Remote Desktop Last Login IP Address Details?
How to find RDP’s last Login IP Address?
This article will describe how to get and audit the RDP connection logs in Windows.
Information about these events is stored in the Event Viewer logs (
- Open the Computer Management Console.
- Navigate to the Operational logs: Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices LocalSessionManager > Operational
- Scroll down to locate the login event.
- Under the “General” tab for that event, it should now show the Source Network Address, which would be the IP of the client connecting to your server.
- Event ID 21 will be a new connection.
- Event ID 24 will be a session disconnect.
- Event ID 25 will be a session reconnect.
From a command prompt on the session host, you can run the following command to get a list of the remote client IPs that are currently connected to RDP (port 3389).
netstat -n | find ":3389" | find "ESTABLISHED"