| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 21 | Information | User logon succeeded via Remote Desktop |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 22 | Information | User logoff succeeded |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 24 | Warning | User disconnected from session |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 25 | Information | User reconnected to session |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 36 | Information | Session created |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 37 | Information | Session terminated |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 39 | Warning | Remote Desktop Services session logon attempt failed |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 40 | Error | Remote Desktop Services session disconnected unexpectedly |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | 1149 | Information | User authentication succeeded |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | 1150 | Warning | User authentication failed |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | 1151 | Information | RDP-TCP connection established |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | 1152 | Warning | RDP-TCP connection disconnected |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | 2049 | Error | Remote Desktop listener stopped responding |
| Microsoft-Windows-TerminalServices-RdpCoreTS/Operational | 131 | Error | RDP protocol component detected an error |
| Microsoft-Windows-TerminalServices-RdpCoreTS/Operational | 140 | Error | Client failed to establish secure channel (TLS/SSL) |
| Microsoft-Windows-TerminalServices-SessionBroker/Operational | 1011 | Information | RD Connection Broker redirected user to session host |
| Microsoft-Windows-TerminalServices-SessionBroker/Operational | 1012 | Error | RD Connection Broker failed to redirect user |
| Microsoft-Windows-TerminalServices-SessionBroker/Operational | 1048 | Information | RD Connection Broker service started |
| Microsoft-Windows-TerminalServices-SessionBroker/Operational | 1049 | Warning | RD Connection Broker service stopped |
| Microsoft-Windows-TerminalServices-Licensing/Operational | 17 | Information | RDS Licensing service started |
| Microsoft-Windows-TerminalServices-Licensing/Operational | 18 | Warning | RDS Licensing service stopped |
| Microsoft-Windows-TerminalServices-Licensing/Operational | 44 | Error | No valid RDS license servers found |
| Microsoft-Windows-TerminalServices-Licensing/Operational | 47 | Error | RDS license expired or invalid |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 302 | Information | User connected via RD Gateway |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 303 | Information | User disconnected from RD Gateway |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 304 | Warning | RD Gateway connection authorization policy failed |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 307 | Error | RD Gateway resource authorization failed |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 312 | Error | Connection failed due to certificate or SSL issue |
| Microsoft-Windows-TerminalServices-Gateway/Operational | 313 | Information | RD Gateway authenticated user credentials |
| Security | 4624 | Information | Successful RDP logon |
| Security | 4625 | Warning | Failed RDP logon attempt |
| Security | 4634 | Information | User logoff event (RDP included) |
| Security | 4778 | Information | User reconnected to an RDP session |
| Security | 4779 | Information | User disconnected from an RDP session |
| System | 7000 | Error | Remote Desktop Services startup failure |
| System | 7036 | Information | Remote Desktop Services entered running/stopped state |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 21 | High | Remote desktop session disconnected unexpectedly |
| Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | 23 | High | Remote desktop session logon failure |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin | 1056 | Critical | Terminal Services listener failed to start |
| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin | 20499 | High | Network connection failure |
| Microsoft-Windows-TerminalServices-SessionBroker/Admin | 1306 | High | Connection broker communication failure |
| Security | 4625 | High | Failed RDP logon attempt |