2

In our organization we have a control that watches users who use high privilege Active Directory accounts to RDP into any server or workstation on our network.

I recently enabled this control which is watching logs related to Windows Terminal Services with specific filters for high privilege access accounts on our domain.

There have been several helpful logs which indicate users using these accounts to RDP, but there are also several logs which indicate RDP activity, but the "Source Network Address" field is "LOCAL."

Here's a sample log (with sensitive info scrubbed):

Microsoft-Windows-TerminalServices-LocalSessionManager/ Operational,01/08/2014,13:31:45 PM,Microsoft-Windows- TerminalServices-LocalSessionManager,21,Information,N/A,None,N/ A,comptername.domain.com,IP:1.1.1.1,21,Remote Desktop Services: Session logon succeeded: User: domain\highaccessaccount Session ID: 1 Source Network Address: LOCAL

My question is, has anybody seen any logs that similar to this, and does anybody have an idea how a user could generate this log with the destination being the local machine?

1
  • 1
    If I had to make an educated guess, I would say that they're logging onto the console session based on the Session ID (1 is Console).
    – Nathan C
    Nov 10, 2014 at 14:19

1 Answer 1

2

I just verified this on Windows Server 2008 R2. That's a local logon directly to the console.

It isn't an mstsc /admin connection to the console session (which will never have a session id of 1).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .