Sometimes as an administrator you may be required to create a detailed report of all Remote Desktop session logon's to a RD Session Host for auditing purposes. All logon requests to a terminal server are recorded to TerminalServices-LocalSessionManager in the event log.
Get-WinEvent -LogName Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | select TimeCreated,Message | Export-Csv c:\output.csv -NoTypeInformation
Simply tap into this with the Get-WinEvent PowerShell cmdlet. The following PowerShell command will create you a spreadsheet in CSV format :