For convenient work recently, I am in the unit with my laptop my desktop remote connection, generally is quitting time is also a desktop also shut down, but two days before I found desktop has been in an open position at work, in the morning I checked the security event (see chart), found that more than 2 points a night landing records, how to view the tracking details?

CodePudding user response:

Not right, I often remote desktop, just looked at, 4778 "other login/logout events" is remote; Other may be a Shared access,
The event description below, switch to the "details". "XML view", after all, there are detailed information, remote login, with each other the name of the machine and the information such as IP,

CodePudding user response:

Administrator account change the password, the disable accounts were banned, machines have sensitive files, we recommend encryption, or only on its own network backup,

CodePudding user response:

There is a remote computer name in, then screen for the computer name is who you ok, or ping the computer name can know IP, can also according to the IP screening