ZEKASTRA

Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop

25 · Remote Desktop Services: Session reconnection succeeded

Logged when a user reconnects to an existing session. The message gives the user, session ID and source network address.

01Fields in the event

  • User
  • Session ID
  • Source Network Address

02How to use it

A reconnection from a new address to an existing session can show a session being taken over from another location; compare with 4778.

03Caveats

Cited from archived Windows Server 2008 R2 documentation; field names are message labels.

05Sources

  1. Microsoft Learn — Event ID 25 — Remote Desktop Services Availability checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.