👤
Username
Identify the Windows account associated with the event.
What RDP login monitoring means
RDP login monitoring is the collection and review of Windows authentication and session events associated with Remote Desktop access. It helps administrators answer practical questions after a support case or incident: who logged in, when did the session start, when did it end and what source IP address was recorded?
🕒
Timestamp
Review when a login, logout or failed-login event occurred.
🌐
Source IP
See the connection source when Windows provides it for the event.
RDP event history versus RDP availability monitoring
| Function | What it tells you |
|---|---|
| TCP monitoring of port 3389 | Whether the RDP service port is reachable from the monitoring location. |
| RDP login-event history | Which Windows account logged in or out and when the event occurred. |
| Synthetic RDP login testing | Whether a complete automated RDP login succeeds. Vigilio does not currently provide this function. |
These functions solve different problems. A reachable port does not prove that a user can complete an RDP login, and an access-event log does not continuously test service availability.
How Vigilio collects the events
- Install the Vigilio Windows agent on the monitored server.
- The agent reads the relevant Windows access events.
- Events are sent to the Vigilio service and associated with the monitored server.
- The dashboard displays event type, username, timestamp and source IP when available.
Privacy and retention: access logs can contain personal or security-relevant information. Define who may view the dashboard and how long event history should be retained under your internal policy.
Useful RDP monitoring scenarios
Investigating an unexpected server change
Compare the time of the change with recent RDP login and logout events to identify which accounts were active around the incident.
Supporting multiple client servers
Review access history without opening Event Viewer on each individual server.
Checking administrative access
Confirm whether an administrator connected during a maintenance window and which source IP was recorded.
What Vigilio does not claim
RDP event history is not a security guarantee. Vigilio does not replace MFA, VPN access controls, account lockout policies, endpoint protection, firewalls or a SIEM. It provides focused visibility that can support administration and incident review.
Monitor it with Vigilio
Create an account, add an external check or install the Windows agent, and receive Telegram alerts for operational incidents.