RDP Activity

Log	Relevant Data	EIDs	Target	Source
Security	Source IP / Source Hostname / Username	4624, 4778
TerminalServices-RDPClient	Destination Hostname / Destination IP	1024, 1102
TerminalServices-RemoteConnectionManager	Success Connections / Attempts / Source IP / Username	98, 131
TerminalServices-LocalSessionManager	Source IP / Username	1149
TerminalServices-LocalSessionManager	Source IP / Username	21, 22, 25, 41