Our Windows 11 lab PCs are accessed over Remote Desktop using a shared local account on each machine. Everyone has a domain account, but we don't use those accounts for the remote sessions.
Is there a way to see who's connected now or who connected previously? Local logs would be enough. I have local admin access, but can't change domain settings.
There's a catch with the shared account. The destination PC's logs will normally identify the local account used for the session, not which coworker was sitting at the other end. They may record a source address, but that isn't necessarily a reliable person identifier.
For a dependable record of individual users, each person would need to authenticate with an individual account rather than the shared local account. You'd need to check what permissions and lab software requirements apply before changing that setup.
For a quick look at current sessions, try query user /server:PCNAME from a command prompt. It shows session information including the account and state, though it won't tell you which coworker is behind a shared account. Remote access and permissions can affect whether the query works.
For history, open Event Viewer on a lab PC and look under Applications and Services Logs, Microsoft, Windows, TerminalServices-LocalSessionManager, Operational. Events 24 and 25 cover session disconnection and reconnection. Check the event details for the session and account information.
You can filter the log or use PowerShell to pull the events into a CSV. A scheduled task triggered by an event could also record updates, but make sure you include enough context to distinguish sessions and test what happens after a reboot or a missed event.
The Security log is another place to check. Event 4624 records successful logons, and 4634 records logoffs when the relevant auditing is enabled. Filter 4624 for logon type 10 to focus on Remote Desktop logons, then inspect the account, time, logon ID, and any source address recorded.
It takes a bit of scripting to turn those events into a readable history, and a logoff event doesn't necessarily tell you when a remote session was disconnected. The shared-account limitation still applies.
If you want one view across all the PCs, you could collect their events and build a small dashboard, or look at dedicated lab management software. That is more setup than local logs, though, and collection won't fix the shared identity problem.
Answers are reviewed before publication.
MAY CONTAIN FOOTNOTES:
Those disconnect and reconnect events are useful for session changes, but they aren't a complete history of who authenticated. Check the other session events too.