How to track all events on the server at a specific time?

Question

RDP

Good afternoon! In the organization, on a certain date (at night, two months ago), one action was performed in the local CRM. You need to understand how and by whom. There can be only two connection options, physically (it disappears immediately) or via RDP. On the router, only a certain Address List has access to the network, which simplifies the task. Everything is clean in the CRM logs, it is likely that they were cleaned. On the server in the event viewer in the RemoteConnectionManager is also empty, I didn’t find it in other logs either, but I honestly don’t know where else to look. Question: Is it possible to see all the events that were on the server at a certain date and time? or how you can understand where the connection came from.