How to find out who and when connected to a PC in a company via RDP?

Question

System administration

Please help.
I came up with such a task from the head.
We need to find out for the last month who connected to our internal network from outside, using what protocols and when
RDP, RTSP, etc.
In general, is it really possible to provide this, they asked me to do an analysis
. I would be grateful for any help.

Answer 1

The internal Windows log on the server has this information.

Answer 2

If all connections are needed, then look at the logs of your router. Or what acts as it.
If specifically RDP - then the RDP server connection log

Answer 3

Take a look here, maybe something will come in handy -> Tracking and Analyzing Remote Desktop Activity Log...
Good luck! )))
PS: Our bosses also toil about such nonsense when they sent everyone to a remote location. But we have RDG deployed and everyone connects through it. Everything is there in the logs.

Answer 4

Everything should be in the Windows logs. True, I don’t know what does RTSP have to do with it - a real-time streaming protocol, which usually uses voice in IP telephony :)

Answer 5

If you need to filter RDP by IP address mask - Allow normal access for all users when connecting from a local area network (LAN), while for connections from an external network (WAN) require the presentation of a 2FA one-time password or electronic key.
www.rohos.ru/2015/03/terminal-server-login-by-sms-otp (paid)