Hi,
if you want to know who and from which station a user logs on via remote desktop you can use the following powershell commands.
List new RemoteDesktop Session
1 | Get-WinEvent -ProviderName Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 21}|select-object Timecreated,Message|fl * |
List established connections to an existing session
1 | Get-WinEvent -ProviderName Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 25}|select-object Timecreated,Message|fl * |
Michael