Event ID 25: Session reconnection succeeded (Microsoft-Windows-TerminalServices-LocalSessionManager/Operational)

Cosa registra davvero questo Event ID su disco, i campi EventData da leggere per primi e dove si colloca in un workflow di triage DFIR.

Canale: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Provider: Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational
Note di triage: Picks up an existing disconnected RDP session.

Microsoft Learn

https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/rdp-error-general-troubleshootingApri la documentazione ufficiale ↗