Export List of Remote Desktop Service Logons from an RD Session Host

Sometimes as an administrator you may be required to create a detailed report of all Remote Desktop session logon's to a RD Session Host for auditing purposes.  All logon requests to a terminal server are recorded to TerminalServices-LocalSessionManager in the event log.

 

Simply tap into this with the Get-WinEvent PowerShell cmdlet.  The following PowerShell command will create you a spreadsheet in CSV format :

 

Get-WinEvent -LogName Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | select TimeCreated,Message | Export-Csv c:\output.csv -NoTypeInformation