# Winlogbeat Remote Desktop Connection Auditing

**URL:** <https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 5, 2016, 10:51am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379 "2016-04-05T10:51:34Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sawwinnnaung](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\
**Post date:** [April 5, 2016, 10:51am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/1 "2016-04-05T10:51:34Z")

</div>

How can I extract remote desktop connection message from winlogbeat

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 5, 2016, 4:50pm UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/2 "2016-04-05T16:50:41Z")

</div>

Configure Winlogbeat to monitor the Security event log. Event [4624](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624) has information about logons including remote desktop connections. According to that page, LogonType 10 is used for Remote Desktop so you could filter in Kibana with (if using Winlogbeat v5):

`event_id: 4624 AND event_data.LogonType: 10`

---

<div class="post-metadata">

**Author:** ![sawwinnnaung](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\
**Post date:** [April 6, 2016, 3:07am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/3 "2016-04-06T03:07:27Z")

</div>

Thanks for your reply @andrewkroh but I can't see the login IP address of RDP connection. Is there anyway to do it.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 6, 2016, 4:24am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/4 "2016-04-06T04:24:09Z")

</div>

I performed a Remote Desktop logon to a Windows 7 Professional box and the IP address was logged in event 4624.

```auto
    ...
    "event_data": {
      "AuthenticationPackageName": "Negotiate",
      "IpAddress": "192.168.99.1",
      "IpPort": "49818",
      "KeyLength": "0",
      "LmPackageName": "-",
      "LogonGuid": "{00000000-0000-0000-0000-000000000000}",
      "LogonProcessName": "User32 ",
      "LogonType": "10",
      "ProcessId": "0x6af0",
      "ProcessName": "C:\\Windows\\System32\\winlogon.exe",
      "SubjectDomainName": "WORKGROUP",
      "SubjectLogonId": "0x3e7",
      "SubjectUserName": "WIN7$",
      "SubjectUserSid": "S-1-5-18",
      "TargetDomainName": "win7",
      "TargetLogonId": "0x9cfa38",
      "TargetUserName": "vagrant",
      "TargetUserSid": "S-1-5-21-1432328479-15621444-2183371920-1000",
      "TransmittedServices": "-",
      "WorkstationName": "WIN7"
    }

```

Make sure that you have auditing enabled for "Audit account logon events" and "Audit logon events". This is enabled through a Group Policy or Local Security Policy.

---

<div class="post-metadata">

**Author:** ![sawwinnnaung](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\
**Post date:** [April 6, 2016, 5:40am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/5 "2016-04-06T05:40:34Z")

</div>

Thanks you so much. I'll try it

---

<div class="post-metadata">

**Author:** ![sawwinnnaung](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\
**Post date:** [April 6, 2016, 5:53am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/6 "2016-04-06T05:53:22Z")

</div>

Could you provide me logstash and winlogbeat configuration files ?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 6, 2016, 6:06am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/7 "2016-04-06T06:06:41Z")

</div>

I'm not using Logstash, and I am using the default config file that Winlogbeat 5.0.0-alpha1 ships with (I only changed the Elasticsearch IP address).

---

<div class="post-metadata">

**Author:** ![sawwinnnaung](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\
**Post date:** [April 6, 2016, 6:30am UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/8 "2016-04-06T06:30:59Z")

</div>

> [@andrewkroh](#):
>
> Winlogbeat 5.0.0-alpha1

Thanks for your information. I am fine with 5.0 alpha1

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 12, 2016, 1:50pm UTC](https://discuss.elastic.co/t/winlogbeat-remote-desktop-connection-auditing/46379/9 "2016-04-12T13:50:43Z")

</div>