Question about RDP - Yes 1149,21,22 But No 4624

Good morning DFIR community,

I was wondering if I could pick your brain on something:

I've got a case where there is suspected RDP access between two devices. On the triage image for the destination device we see EventID 1149 as well as Event ID 21 and 22, but no 4624. I was wondering if anyone had any insight as to why we might see Event IDs for the Network Connection (1149) as well as the Logon (21 and 22), …

access brain case community computerforensics device devices dfir event good image question rdp rdp access triage yes