ZEKASTRA

Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop

24 · Remote Desktop Services: Session has been disconnected

Logged when a session is disconnected. The message gives the user, session ID and source network address.

01Fields in the event

  • User
  • Session ID
  • Source Network Address

02How to use it

Marks the end of an active connection while the session stays alive; pair with 25 to find reconnections from different addresses.

03Caveats

Disconnection is not logoff. Cited from archived Windows Server 2008 R2 documentation; field names are message labels.

05Sources

  1. Microsoft Learn — Event ID 24 — Remote Desktop Services Availability checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.