Remote Desktop user authentication succeeded

What it means

A Remote Desktop connection was authenticated. Includes the user and source IP address.

Why it matters

Shows exactly who connected by RDP and from where; internet-facing RDP should never appear.

What to do

• Alert on RDP sources outside your network or VPN range.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; Id = 1149
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.