标题: 查询Windows远程桌面及本地登录记录 [打印本页]

---

作者: linda    时间: 2019-9-19 18:33     标题: 查询Windows远程桌面及本地登录记录

if you want to know who and from which station a user logs on via remote desktop you can use the following powershell commands.

本地登录：
Get-WinEvent -ProviderName   Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 21}|select-object Timecreated,Message|fl *

远程登录(显示来源IP地址):
Get-WinEvent -ProviderName   Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 25}|select-object Timecreated,Message|fl *

原文: https://michlstechblog.info/blog/windows-get-a-list-of-remote-desktop-logons/#more-6302

[ 本帖最后由 linda 于 2019-9-19 18:35 编辑 ]

---

欢迎光临 中神通公司技术论坛 (http://trustcomputing.com.cn/bbs/)

Powered by Discuz! 6.0.0