TerminalServices Event ID 1149 — Remote Desktop authentication succeeded

TerminalServices-RemoteConnectionManager event 1149: a user successfully authenticated to a Remote Desktop session. Records the User, Domain and Source Network Address. Note this logs successful authentication at the RDP layer, not necessarily a completed interactive logon.

Why event 1149 matters

1149 preserves the source IP of RDP connections even where 4624 LogonType 10 is centralised elsewhere. External or untrusted source addresses, RDP from workstations into servers, or a burst of 4625 failures followed by a 1149 all indicate compromise or lateral movement over RDP.

How to detect it

Alert on 1149 from public or untrusted source addresses. Correlate with 4624 LogonType 10 and 4625 spikes for brute-force follow-through. Baseline approved jump-host and admin patterns.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: RDP Authentication From Untrusted Source
status: experimental
logsource:
  product: windows
  service: terminalservices-remoteconnectionmanager
detection:
  sel:
    EventID: 1149
  condition: sel
level: medium

Event
| where EventLog == "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" and EventID == 1149   // Remote Desktop authentication succeeded
// EventData holds: User, Source Network Address, Domain
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Remote Desktop authentication succeeded — add EventData fields: User, Source Network Address, Domain`

References

• learn.microsoft.com