How to find remote desktop users' logon time

• Identify the domain from which you need the logon information.
• Identify the attributes that you want listed.
• Determine the remote computer from which you need to collect the logs. You need the IP address, NETBIOS name or the FQDN of the remote computer.
• Compile the script.
• Execute it in Windows PowerShell
• The report will be exported in the given format.
• To obtain the report in a different format, modify the script accordingly.

Here is a sample script:

$colEvents = Get-WinEvent -ComputerName $ComputerName -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |  
Where {$_.ID -eq "21"} |  
Select -Property TimeCreated, Message 
Write-Host "Login Time,Username" 
Foreach ($Event in $colEvents) 
{ 
  $EventTimeCreated = $Event.TimeCreated 
  $EventMessage = $Event.Message -split "`n" | Select-Object -Index "2" 
  $EventMessageUser = $EventMessage.Substring(6) 
  Write-Host "$EventTimeCreated,$EventMessageUser" 
} 
Export-CSV “C:\Temp\RemoteUserLogonTime.CSV” -NoTypeInformation

• Select Remote Desktop Services Activity from Reports>Local Logon-Logoff
• Select the Domain and OU and then click generate.
• You can export the report in the various formats listed (CSV, PDF, HTML, CSVDE and XLSX).

Screenshot