In our organization we have a control that watches users who use high privilege Active Directory accounts to RDP into any server or workstation on our network.
I recently enabled this control which is watching logs related to Windows Terminal Services with specific filters for high privilege access accounts on our domain.
There have been several helpful logs which indicate users using these accounts to RDP, but there are also several logs which indicate RDP activity, but the "Source Network Address" field is "LOCAL."
Here's a sample log (with sensitive info scrubbed):
Microsoft-Windows-TerminalServices-LocalSessionManager/ Operational,01/08/2014,13:31:45 PM,Microsoft-Windows- TerminalServices-LocalSessionManager,21,Information,N/A,None,N/ A,comptername.domain.com,IP:220.127.116.11,21,Remote Desktop Services: Session logon succeeded: User: domain\highaccessaccount Session ID: 1 Source Network Address: LOCAL
My question is, has anybody seen any logs that similar to this, and does anybody have an idea how a user could generate this log with the destination being the local machine?