Hi,

if you want to know who and from which station a user logs on via remote desktop you can use the following powershell commands.

List new RemoteDesktop Session

Get-WinEvent -ProviderName   Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 21}|select-object Timecreated,Message|fl *

List established connections to an existing session

Get-WinEvent -ProviderName   Microsoft-Windows-TerminalServices-LocalSessionManager|?{$_.ID -eq 25}|select-object Timecreated,Message|fl *

Michael