RDP Event ID 1149: rdp authentication succeeded
What RDP Event ID 1149 (rdp authentication succeeded) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 1149 in the RemoteConnectionManager log is written when a Remote Desktop connection passes authentication. It is often the quickest way to answer "who RDPed into this server and from where", because it lists the user and the source address on one line. It does not by itself prove a full session started: that is 4624 with logon type 10 (or 7 for a reconnect) in the Security log.
The fields that matter
| Field | What it tells you |
|---|---|
| User | The account name that authenticated. |
| Domain | The account's domain, or the computer name for a local account. |
| Source Network Address | Where the connection came from. |
What is normal
Admins connecting to servers from their jump host or VPN range during working hours.
When RDP Event ID 1149 is suspicious
- A public IP address as the source: RDP is exposed to the internet.
- RDP into a workstation, or from one workstation to another, where your admins only ever use jump hosts.
- An account that has never used RDP, or a service account.
- A 1149 right after a run of 4625 failures for the same account.
- Connections at hours when nobody in the team works.
Common false positive: Vendors and MSPs connecting from their own offices show up with unfamiliar public IPs. Keep a list of approved sources and check the IP owner.
Find RDP Event ID 1149 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; Id=1149; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
Event
| where TimeGenerated > ago(7d) and EventLog == "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" and EventID == 1149
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated descRelated events
- Event ID 4624: Successful logon
- Event ID 4625: Failed logon
- RDP Event ID 21: RDP session logon succeeded
- Event ID 4778
For a full walk-through, read Windows logon types explained.
FAQ
Where is Event ID 1149 logged?
In Applications and Services Logs > Microsoft > Windows > TerminalServices-RemoteConnectionManager > Operational.
Does Event ID 1149 mean the logon succeeded?
It means the connection authenticated. Confirm the full logon with Security Event ID 4624 logon type 10, or 7 for a reconnected session.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.