ZEKASTRA

Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop

21 · Remote Desktop Services: Session logon succeeded

Logged by the Local Session Manager when a session logon succeeds. The message gives the user, session ID and source network address.

01Fields in the event

  • User
  • Session ID
  • Source Network Address

02How to use it

Confirms interactive or RDP sessions on the host even when Security logs are missing. Compare the source address with 4624 LogonType 10 and with 24/25 for the same session ID.

03Caveats

The listed names are message labels from archived Windows Server 2008 R2 documentation, not XML field names. Console logons show a local source address.

05Sources

  1. Microsoft Learn — Event ID 21 — Remote Desktop Services Availability checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.