Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Description

Remote Desktop Services Remote Connection Manager is starting up.

Message #

Remote Desktop Services Remote Connection Manager is starting up

Description

Remote Desktop Services Remote Connection Manager has finished start up. Return code isSuccess.

Message #

Remote Desktop Services Remote Connection Manager has finished start up. Return code %1

Fields #

Description

Listener has started listening.

Message #

Listener %1 has started listening

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 258,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2019-02-13T17:18:30.771694+00:00",
    "event_record_id": 221,
    "correlation": {
      "ActivityID": "00000000-0244-0000-C48E-2E890BC4D401"
    },
    "execution": {
      "process_id": 1280,
      "thread_id": 1548
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "xmlns:auto-ns2": "http://schemas.microsoft.com/win/2004/08/events",
      "listenerName": "RDP-Tcp"
    }
  },
  "message": "Listener http://schemas.microsoft.com/win/2004/08/events has started listening"
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

Listener listenerName has stopped listening.

Message #

Listener %1 has stopped listening

Fields #

Description

Listener listenerName failed while listening. Error code errorCode.

Message #

Listener %1 failed while listening. Error code %2

Fields #

Description

Listener received a connection.

Message #

Listener %1 received a connection

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 261,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2019-02-13T18:04:45.905782+00:00",
    "event_record_id": 227,
    "correlation": {},
    "execution": {
      "process_id": 1280,
      "thread_id": 1876
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "xmlns:auto-ns2": "http://schemas.microsoft.com/win/2004/08/events",
      "listenerName": "RDP-Tcp"
    }
  },
  "message": "Listener http://schemas.microsoft.com/win/2004/08/events received a connection"
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

Listener listenerName has been asked to stop listening.

Message #

Listener %1 has been asked to stop listening

Fields #

Description

WDDM graphics mode is enabled.

Message #

WDDM graphics mode is enabled

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 263,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-03-11T06:27:38.404213+00:00",
    "event_record_id": 253,
    "correlation": {
      "ActivityID": "F4626F1C-FB1F-4005-81D8-895393540000"
    },
    "execution": {
      "process_id": 1536,
      "thread_id": 2316
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Description

Connection with ID Param1 has started.

Message #

Connection with ID %1 has started

Fields #

Description

Connection with ID Param1 for session Param2 has completed, total time Param3 (ms), stack time Param4 (ms).

Message #

Connection with ID %1 for session %2 has completed, total time %3 (ms), stack time %4 (ms)

Fields #

Description

Reconnect connection ID Param1 to session Param2 took Param3 (ms).

Message #

Reconnect connection ID %1 to session %2 took %3 (ms)

Fields #

Description

The remote desktop client 'Param1' has provided an invalid license.

Message #

The remote desktop client '%1' has provided an invalid license.

Fields #

Message #

The Remote Desktop Session Host server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Description

The RD Session Host server received large number of incomplete connections. The system may be under attack.

Message #

The RD Session Host server received large number of incomplete connections.  The system may be under attack.

Description

The remote session could not be established from remote desktop client Param1 because its temporary license has expired.

Message #

The remote session could not be established from remote desktop client %1 because its temporary license has expired.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "{C76BAA63-AE81-421C-B425-340B4B24157F}",
    "event_source_name": "TermService",
    "event_id": 1056,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T21:47:52.000000Z",
    "event_record_id": 2660,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

The RD Licensing mode has not been configured.

Message #

The RD Licensing mode has not been configured.

Description

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Session Host server has not been configured. Licensing mode must be configured for continuous operation.

Message #

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Session Host server has not been configured. Licensing mode must be configured for continuous operation.

Description

RD Session Host Server role is not installed.

Message #

RD Session Host Server role is not installed.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 1136,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2019-02-13T17:18:41.657347+00:00",
    "event_record_id": 222,
    "correlation": {},
    "execution": {
      "process_id": 1008,
      "thread_id": 2440
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "RD Session Host Server role is not installed."
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

The roaming user profile cache manager for Remote Desktop Services could not start. Error Code: Param1.

Message #

The roaming user profile cache manager for Remote Desktop Services could not start. Error Code: %1

Fields #

Description

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the monitoring interval. Error Code: Param1.

Message #

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the monitoring interval. Error Code: %1

Fields #

Description

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the maximum cache size. Error Code: Param1.

Message #

The roaming user profile cache manager for Remote Desktop Services could not start because an incorrect value was specified for the maximum cache size. Error Code: %1

Fields #

Message #

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1

Fields #

Message #

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled, but the roaming user profile cache manager for Remote Desktop Services has encountered a problem. Error Code: %1

Fields #

Description

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled.

Message #

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been enabled.

Description

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.

Message #

The "Limit the size of the entire roaming user profile cache" Group Policy setting has been disabled.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 1143,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-03-13T18:27:00.338529+00:00",
    "event_record_id": 177,
    "correlation": {},
    "execution": {
      "process_id": 2248,
      "thread_id": 10044
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Message #

The roaming user profile cache manager for Remote Desktop Services could not delete the roaming user profile for the user %1. The roaming user profile cache might still exceed the %2 gigabyte limit. Error Code: %3

Fields #

Description

The roaming user profile cache manager for Remote Desktop Services deleted the roaming user profile for the user Param1 because the roaming user profile cache exceeded the Param2 gigabyte limit.

Message #

The roaming user profile cache manager for Remote Desktop Services deleted the roaming user profile for the user %1 because the roaming user profile cache exceeded the %2 gigabyte limit.

Fields #

Description

Remote Desktop Services: Remote control session initiated.

Message #

Remote Desktop Services: Remote control session initiated:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields #

Description

Remote Desktop Services: Remote control session connection succeeded.

Message #

Remote Desktop Services: Remote control session connection succeeded:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields #

Description

Remote Desktop Services: Remote control session connection failed.

Message #

Remote Desktop Services: Remote control session connection failed:

%1 initiated a remote control session:
User: %2
Domain: %3

Fields #

Description

Remote Desktop Services: User authentication succeeded.

Message #

Remote Desktop Services: User authentication succeeded:

User: %1
Domain: %2
Source Network Address: %3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 1149,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2019-02-13T18:04:57.452387+00:00",
    "event_record_id": 228,
    "correlation": {},
    "execution": {
      "process_id": 1280,
      "thread_id": 2748
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "xmlns:auto-ns2": "http://schemas.microsoft.com/win/2004/08/events",
      "Param1": "admin01",
      "Param2": "example",
      "Param3": "127.0.0.1"
    }
  },
  "message": "Remote Desktop Services: User authentication succeeded:\n\nUser: http://schemas.microsoft.com/win/2004/08/events\nDomain: admin01\nSource Network Address: example"
}

Community Notes #

RDP user auth succeeded, combine with 4624 (successful logon)/4625 (logoff) to track lateral movement.

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

Remote Desktop Services: User config data have been merged.

Message #

Remote Desktop Services: User config data have been merged:

User: %1
Domain: %2
Source Network Address: %3

Fields #

Description

The remote user's connection was declined by the logged on user.

Message #

The remote user's connection was declined by the logged on user.

User Account: %2
Domain: %1
Source IP Address: %3

Fields #

Description

Failed to create KVP sessions string. Error Code Param1.

Message #

Failed to create KVP sessions string. Error Code %1

Fields #

Description

Failed to write KVP sessions string. Error Code Param1.

Message #

Failed to write KVP sessions string. Error Code %1

Fields #

Description

Failed to open KVP registry key. Error Code {Param1}.

Message #

Failed to open KVP registry key. Error Code {Param1}

Fields #

Description

The Remote Connection Manager selected Kernel mode RDP protocol stack.

Message #

The Remote Connection Manager selected Kernel mode RDP protocol stack.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 1155,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2019-02-13T17:18:28.040385+00:00",
    "event_record_id": 220,
    "correlation": {
      "ActivityID": "8F0C0C22-A5AA-4F83-B10F-0880AB96471F"
    },
    "execution": {
      "process_id": 1280,
      "thread_id": 1548
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "PC01.example.corp",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": "The Remote Connection Manager selected Kernel mode RDP protocol stack."
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

The Remote Connection Manager selected User mode RDP protocol stack.

Message #

The Remote Connection Manager selected User mode RDP protocol stack.

Description

The listener named listenerName has modified some configuration settings.

Message #

The listener named %1 has modified some configuration settings.

Fields #

Description

Remote Desktop Services accepted a connection from IP address EventXML.Param1.

Message #

Remote Desktop Services accepted a connection from IP address %1.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 1158,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T16:46:57.106454+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "F420602A-491C-41CA-97CE-1A07AEAA0000"
    },
    "execution": {
      "process_id": 1472,
      "thread_id": 4588
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "Param1": "198.51.100.2"
    }
  },
  "message": ""
}

Description

Remote Desktop Configuration service could not remove user Param1\Param2 from administrators group, error Code: Param3.

Message #

Remote Desktop Configuration service could not remove user %1\%2 from administrators group, error Code: %3

Fields #

Description

Remote Desktop Configuration service could not remove user Param1\Param2 from Remote Desktop Users group, error Code: Param3.

Message #

Remote Desktop Configuration service could not remove user %1\%2 from Remote Desktop Users group, error Code: %3

Fields #

Description

Remote Desktop Configuration service could not remove user with SID Param1 from administrators group, error Code: Param2.

Message #

Remote Desktop Configuration service could not remove user with SID %1 from administrators group, error Code: %2

Fields #

Description

Remote Desktop Configuration service could not remove user with SID Param1 from Remote Desktop Users group, error Code: Param2.

Message #

Remote Desktop Configuration service could not remove user with SID %1 from Remote Desktop Users group, error Code: %2

Fields #

Description

Remote Desktop Configuration service has added user Param1\Param2 to administrators group.

Message #

Remote Desktop Configuration service has added user %1\%2 to administrators group

Fields #

Description

Remote Desktop Configuration service has added user Param1\Param2 to Remote Desktop Users group.

Message #

Remote Desktop Configuration service has added user %1\%2 to Remote Desktop Users group

Fields #

Description

Remote Desktop Configuration service has removed user with SID Param1 from administrators group.

Message #

Remote Desktop Configuration service has removed user with SID %1 from administrators group

Fields #

Description

Remote Desktop Configuration service has removed user with SID Param1 from Remote Desktop Users group.

Message #

Remote Desktop Configuration service has removed user with SID %1 from Remote Desktop Users group

Fields #

Description

Remote Desktop Configuration service has removed user Param1\Param2 from administrators group.

Message #

Remote Desktop Configuration service has removed user %1\%2 from administrators group

Fields #

Description

Remote Desktop Configuration service has removed user Param1\Param2 from Remote Desktop Users group.

Message #

Remote Desktop Configuration service has removed user %1\%2 from Remote Desktop Users group

Fields #

Fields #

Fields #

Fields #

Fields #

Description

Remote Desktop Services Network Fair Share started.

Message #

Remote Desktop Services Network Fair Share started.

Description

Remote Desktop Services Network Fair Share stopped.

Message #

Remote Desktop Services Network Fair Share stopped.

Description

Remote Desktop Services Network Fair Share was enabled for the user account Param1 with a weight of Param2.

Message #

Remote Desktop Services Network Fair Share was enabled for the user account %1 with a weight of %2.

Fields #

Description

Remote Desktop Service Network Fairshare has been enabled for connection on session Param1 with weight of Param2.

Message #

Remote Desktop Service Network Fairshare has been enabled for connection on session %1 with weight of %2.

Fields #

Description

Remote Desktop Services could not enable Network Fair Share for the user account Param1. The error code is Param2.

Message #

Remote Desktop Services could not enable Network Fair Share for the user account %1. The error code is %2.

Fields #

Description

Remote Desktop Services could not enable Network Fair Share for the connection on session Param1. The error code is Param2.

Message #

Remote Desktop Services could not enable Network Fair Share for the connection on session %1. The error code is %2.

Fields #

Description

Remote Desktop Services could not enable Network Fair Share for session Param1. The error code is Param2.

Message #

Remote Desktop Services could not enable Network Fair Share for session %1. The error code is %2.

Fields #

Description

Remote Desktop Services Network Fair Share was disabled for the user account Param1.

Message #

Remote Desktop Services Network Fair Share was disabled for the user account %1.

Fields #

Description

Remote Desktop Services Network Fair Share was disabled for the connection on session Param1.

Message #

Remote Desktop Services Network Fair Share was disabled for the connection on session %1.

Fields #

Description

Remote Desktop Services could not disable Network Fair Share for the user account Param1. The error code is Param2.

Message #

Remote Desktop Services could not disable Network Fair Share for the user account %1. The error code is %2.

Fields #

Description

Remote Desktop Services could not disable Network Fair Share for the connection on session Param1. The error code is Param2.

Message #

Remote Desktop Services could not disable Network Fair Share for the connection on session %1. The error code is %2.

Fields #

Description

Remote Desktop Services could not disconnect a user disk for the user account with a SID of Param1. The error code is Param2.Param3.

Message #

Remote Desktop Services could not disconnect a user disk for the user account with a SID of %1. The error code is %2.%3

Fields #

Description

Remote Desktop Services could not detach a user disk for the user account with a SID of Param1. The error code is Param2.Param3.

Message #

Remote Desktop Services could not detach a user disk for the user account with a SID of %1. The error code is %2.%3

Fields #

Message #

Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile was enforced for the user. Verify that the user profile disk settings are correct. The error code is %2.%3

Fields #

Message #

Remote Desktop Services could not obtain a user profile disk for the user account with a SID of %1. Verify that the user profile disk location is accessible, the server's computer account has read and write permissions to it, and that the location has a user profile disk template file present. The error code is %2.%3

Fields #

Description

Remote Desktop Services could not attach a user profile disk for a user account with a SID of Param1. The error code is Param2.Param3.

Message #

Remote Desktop Services could not attach a user profile disk for a user account with a SID of %1. The error code is %2.%3

Fields #

Message #

Remote Desktop Services could not apply a user desktop for a user account with a SID of %1. A temporary profile could not be enforced for the user. The user will get a normal profile, and the user's state will be discarded when the user logs off. Verify that the user profile disk settings are correct. The error code is %2.%3

Fields #

Description

The RD Licensing has taken too long to process the client license.

Message #

The RD Licensing has taken too long to process the client license

Description

Remote Desktop Services has taken too long to complete the client connection.

Message #

Remote Desktop Services has taken too long to complete the client connection

Description

Remote Desktop Services has taken too long to load the user configuration from server UserName for user ServerName.

Message #

Remote Desktop Services has taken too long to load the user configuration from server %1 for user %2

Fields #

Description

Remote Desktop Services took time milliseconds to load the user configuration from server UserName for user ServerName.

Message #

Remote Desktop Services took %3 milliseconds to load the user configuration from server %1 for user %2

Fields #

Description

Remote Desktop Services failed to shutdown within the time allocated.

Message #

Remote Desktop Services failed to shutdown within the time allocated

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 20501,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T18:32:00.352717+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 1480,
      "thread_id": 12992
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Description

Remote Desktop Services failed to retrieve information about a connection for session Session within the time allocated.

Message #

Remote Desktop Services failed to retrieve information about a connection for session %1 within the time allocated

Fields #

Description

Shadow View Session Started.

Message #

Shadow View Session Started

User %1 on computer %2 viewing user %3 (Session ID: %4)

Fields #

Description

Shadow View Session Stopped.

Message #

Shadow View Session Stopped

User %1 on computer %2 viewing user %3 (Session ID: %4)

Fields #

Description

Shadow Control Session Started.

Message #

Shadow Control Session Started

User %1 on computer %2 controlling user %3 (Session ID: %4)

Fields #

Description

Shadow Control Session Stopped.

Message #

Shadow Control Session Stopped

User %1 on computer %2 controlling user %3 (Session ID: %4)

Fields #

Description

Shadow View Permission Granted.

Message #

Shadow View Permission Granted

User %1 (Session ID: %3) granted permission to user %2

Fields #

Description

Shadow View Permission Denied.

Message #

Shadow View Permission Denied

User %1 (Session ID: %3) denied permission to user %2

Fields #

Description

Shadow Control Permission Granted.

Message #

Shadow Control Permission Granted

User %1 (Session ID: %3) granted permission to user %2

Fields #

Description

Shadow Control Permission Denied.

Message #

Shadow Control Permission Denied

User %1 (Session ID: %3) denied permission to user %2

Fields #

Description

Shadow Session Failure.

Message #

Shadow Session Failure

User %2 encountered error %3 trying to shadow user %1 (Session ID: %4)

Fields #

Description

Shadow Session Failure.

Message #

Shadow Session Failure

User %2 was unable to shadow user %1 (Session ID: %3) because of group policy settings.

Fields #

Description

Shadow Session Failure.

Message #

Shadow Session Failure

User %2 was unable to shadow user %1 (Session ID: %3) because that session is already being shadowed.

Fields #

Description

Session Session has been idle over its time limit, and was logged off.

Message #

Session %1 has been idle over its time limit, and was logged off

Fields #

Description

Session Session has been idle over its time limit, and was disconnected.

Message #

Session %1 has been idle over its time limit, and was disconnected

Fields #

Description

Session Session has exceeded its time limit, and was logged off.

Message #

Session %1 has exceeded its time limit, and was logged off

Fields #

Description

Session Session has exceeded its time limit, and was disconnected.

Message #

Session %1 has exceeded its time limit, and was disconnected

Fields #

Description

Session Session has exceeded its disconnect time limit, and was logged off.

Message #

Session %1 has exceeded its disconnect time limit, and was logged off

Fields #

Description

User config info will be loaded from domain controller for this Param1 connection.

Message #

User config info will be loaded from domain controller for this %1 connection

Fields #

Description

User config info will be loaded from local machine for this EventXML.Param1 connection.

Message #

User config info will be loaded from local machine for this %1 connection

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 20521,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-11T06:31:11.531699+00:00",
    "event_record_id": 16,
    "correlation": {
      "ActivityID": "F420649C-F05B-4253-B980-683E9A630000"
    },
    "execution": {
      "process_id": 1536,
      "thread_id": 2316
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "Param1": "RDP-Tcp"
    }
  },
  "message": ""
}

Description

Shadow Session Clipboard Copy Request.

Message #

Shadow Session Clipboard Copy Request

User %1 on computer %2 controlling user %3 (Session ID: %4) Clipboard format: %5

Fields #

Description

Connection from listener EventXML.ListenerName will have terminal class of EventXML.Class.

Message #

Connection from listener %1 will have terminal class of %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
    "guid": "C76BAA63-AE81-421C-B425-340B4B24157F",
    "event_source_name": "",
    "event_id": 20523,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-03-11T06:27:24.766379+00:00",
    "event_record_id": 244,
    "correlation": {
      "ActivityID": "F462B7C1-94B7-4A0B-B9BF-0F6B56B60000"
    },
    "execution": {
      "process_id": 1536,
      "thread_id": 1836
    },
    "channel": "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "user_data": {
    "EventXML": {
      "ListenerName": "31C5CE94259D4006A9E4",
      "Class": "D5993EAE-8D06-4A05-9CB4-94CEA280DC6B"
    }
  },
  "message": ""
}

Description

Supplemental Kerberos credentials are not configured.

Message #

Supplemental Kerberos credentials are not configured

Description

Successfully updated supplemental Kerberos credential Param1 in Param2 logon session.

Message #

Successfully updated supplemental Kerberos credential %1 in %2 logon session

Fields #

Description

Successfully removed supplemental Kerberos credential Param1 from Param2 logon session.

Message #

Successfully removed supplemental Kerberos credential %1 from %2 logon session

Fields #

Description

Failed to update supplemental Kerberos credentials. Param1.

Message #

Failed to update supplemental Kerberos credentials. %1

Fields #

Description

Failed to update supplemental Kerberos credential Param1 in Param2 logon session. Param3.

Message #

Failed to update supplemental Kerberos credential %1 in %2 logon session. %3

Fields #

Description

Failed to remove supplemental Kerberos credential Param1 from Param2 logon session. Param3.

Message #

Failed to remove supplemental Kerberos credential %1 from %2 logon session. %3

Fields #

Description

Supplemental Kerberos credential Param1 configuration is invalid. Param2.

Message #

Supplemental Kerberos credential %1 configuration is invalid. %2

Fields #

Message #

Remote Desktop Service's Threadpool is in terminated state. Remote Desktop Connections may not work, this usually happens when TermService is being shutdown. If this was unintentional, restart Termservice manually.

Description

Remote Desktop Configuration service could not remove user {Param1}\{Param2} from administrators group; error Code: {Param3}.

Message #

Remote Desktop Configuration service could not remove user {Param1}\{Param2} from administrators group; error Code: {Param3}

Fields #

Description

Remote Desktop Configuration service could not remove user with SID {Param1} from administrators group; error Code: {Param2}.

Message #

Remote Desktop Configuration service could not remove user with SID {Param1} from administrators group; error Code: {Param2}

Fields #

Description

Remote Desktop Configuration service has added user {Param1}\{Param2} to administrators group.

Message #

Remote Desktop Configuration service has added user {Param1}\{Param2} to administrators group

Fields #

Description

The remote session could not be established from remote desktop client Param1 because its license could not be renewed.

Message #

The remote session could not be established from remote desktop client %1 because its license could not be renewed.

Fields #

Message #

The Remote Desktop Session Host server cannot communicate with the Remote Desktop license server %1. Ensure that the computer account for the Remote Desktop Session Host server is a member of the RDS Endpoint Servers group on the license server.

Fields #

Description

Remote Desktop Session Host server was unable to retrieve users licensing information from AD. Error errorCode.

Message #

Remote Desktop Session Host server was unable to retrieve users licensing information from AD. Error %1

Fields #

Description

Remote Desktop Session Host server was successfully validated errorCode licensing information from AAD.

Message #

Remote Desktop Session Host server was successfully validated %1 licensing information from AAD.

Fields #

Description

Remote Desktop Session Host server was unable to retrieve user licensing information from AAD. Error errorCode.

Message #

Remote Desktop Session Host server was unable to retrieve user licensing information from AAD. Error %1

Fields #

Description

Remote Desktop Session Host server was unable to validate RDS license. Error errorCode.

Message #

Remote Desktop Session Host server was unable to validate RDS license. Error %1

Fields #

Message #

The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a license server for 120 days after initial start up.

Message #

The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Session Host server can operate without a license server for 120 days after initial start up.

Fields #

Message #

The Remote Desktop Session Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Session Host server, use the Remote Desktop Session Host Configuration tool.

Message #

The Remote Desktop Session Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license server is registered in WINS and DNS.

Fields #

Description

The Remote Desktop license server Param1 does not support the version of the operating system running on the Remote Desktop Session Host server.

Message #

The Remote Desktop license server %1 does not support the version of the operating system running on the Remote Desktop Session Host server.

Fields #

Message #

The certificate issued by the Remote Desktop license server to the Remote Desktop Session Host server is not valid. The license server will not issue Remote Desktop Services client access licenses to clients connecting to the Remote Desktop Session Host server. To resolve this issue, delete the certificate on the Remote Desktop Session Host server and then restart the Remote Desktop Services service.

Message #

The Remote Desktop Virtualization Host server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Description

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Virtualization Host server has not been configured. Licensing mode must be configured for continuous operation.

Message #

The RD Licensing grace period has expired and Licensing mode for the Remote Desktop Virtualization Host server has not been configured. Licensing mode must be configured for continuous operation.

Message #

The RD Licensing grace period has expired and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate without a license server for 120 days after initial start up.

Message #

The RD Licensing grace period is about to expire on %1 and the service has not registered with a license server with installed licenses. A RD Licensing server is required for continuous operation. A Remote Desktop Virtualization Host server can operate without a license server for 120 days after initial start up.

Fields #

Message #

The Remote Desktop Virtualization Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Virtualization Host server, use the RDS module for Windows PowerShell.

Message #

The Remote Desktop Virtualization Host server could not contact the Remote Desktop license server %1. Ensure that the Remote Desktop Licensing service is running on the license server, that the license server is accepting network requests, and that the license server is registered in WINS and DNS.

Fields #