Tracking the entire history of RDP sessions - powershell

Question

We are trying to get the entire history of rdp servers via powershell.
I already looked at some example's like Qwinsta, quser, query user;
but that is not exactly what I am looking for.
I am looking for something I can write in Powershell to give me the entire history of it. from the day the machine is up.
example :
lets say I have a server I created last year.
I want to know who are the users that has logged into this server in the last year, which one is diss or active (kind of like query user or qwinsta) and when was the last time someone connected to this server.
NAME_OF_SERVER
SESSIONNAME USERNAME ID STATE DEVICE LAST_LOGIN
services 0 Disc
console 1 Conn
rdp-tcp#29 user1 2 Active
user2 3 Disc
appreciate any kind of help.

Answer 1

You can find the history by querying for RDP event logs. There's a handful of different events that will denote an RDP logon, but I'm going to use the RemoteConnectionManager log here:
$RDPAuths = Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' -FilterXPath #'
<QueryList><Query Id="0"><Select>
*[System[EventID=1149]]
</Select></Query></QueryList>
'#
# Get specific properties from the event XML
[xml[]]$xml=$RDPAuths|Foreach{$_.ToXml()}
$EventData = Foreach ($event in $xml.Event) {
# Create custom object for event data
New-Object PSObject -Property #{
TimeCreated = (Get-Date ($event.System.TimeCreated.SystemTime) -Format 'yyyy-MM-dd hh:mm:ss K')
User = $event.UserData.EventXML.Param1
Domain = $event.UserData.EventXML.Param2
Client = $event.UserData.EventXML.Param3
}
}
$EventData | FT
You could pretty easily sort by user and find the last time they logged in using the output in $EventData:
TimeCreated User Domain Client
----------- ---- ------ ------
2021-09-23 12:02:03 -04:00 User01 MyDomain 10.10.10.10
2021-09-23 12:00:42 -04:00 User01 MyDomain 10.10.10.10
2021-09-21 11:39:08 -04:00 User02 MyDomain 10.10.10.20
There's an obvious limitation here that you can only search as far back as your event log goes, so "from the day the machine is up." may not be possible depending on how your event logs are configured.
Another option here can be to just check C:\users\* for which users have ever logged in.
For checking current sessions, I mostly use quser. If your server is running Terminal Services, you can use the RemoteDesktop module and run commands like Get-RDUserSession.