Event ID 23: Session logoff succeeded (Microsoft-Windows-TerminalServices-LocalSessionManager/Operational)

Cosa registra davvero questo Event ID su disco, i campi EventData da leggere per primi e dove si colloca in un workflow di triage DFIR.

Canale: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Provider: Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational
Note di triage: Clean RDP logoff.

Microsoft Learn

https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/rdp-error-general-troubleshootingApri la documentazione ufficiale ↗