I'd like to know when remote access was turned on on my computer. I'm sure I had it off. is there an event that is generated for that? Also, what event is generated by disabling changing my windows password on UAC and the lock screen. I want to get proof that someone entered my apartment and did these things. Thanks for any help.

Hi @ Jim Schwartz , you can check the event log for event id 4624 (succesful login, logon type 3 = network) and 4625 (login failed). (If the reply was helpful please don't forget to upvote and/or accept as answer , thank you) Regards Andreas Baumgarten

I was hacked and I think by someone entering my apartment

Accepted answer

Andreas Baumgarten 111.3K Reputation points MVP

2024-08-30T14:03:03.4866667+00:00

Hi @Jim Schwartz ,

you can check the event log for event id 4624 (succesful login, logon type 3 = network) and 4625 (login failed).

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.

1 person found this answer helpful.
Jim Schwartz 41 Reputation points

2024-08-30T14:41:04.7933333+00:00

duplicate

Jim Schwartz 41 Reputation points

2024-08-30T14:45:10.61+00:00

Why do my search results only show 2 days of windows log ins? does that mean someone deleted entries or do I have to change a setting? I did say All Time in my custom view. What event is generated by enabling remote desktop? That would be great to know since they would have to be in my apartment to do that.

Andreas Baumgarten 111.3K Reputation points MVP

2024-08-30T15:48:35.8+00:00

Hi @Jim Schwartz ,

it's possible to enable Remote Desktop from remote without "physically access" to the computer. This is possible by setting a parameter in the registry remotely/via network access.

Basically it's a registry setting that enables/disables Remote Desktop. It's the DWORD fDenyTSConnections 0 or 1 at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server .

As far as I know there is no dedicated event id for enabling /disabling Remote Desktop.

Regarding the amount of entries in the event log: It depends on the settings of each event log. I am not 100% sure but I think it will be overwrite events (oldest first) if the size reached a threshold of xxx KB.

If you clear an eventlog you will get a new event with event id 1102 (The audit log was cleared.) after the deletion is done. If you clear the security log the entry will be in the Security event log. If you clear the Application or System eventlog this will be recorded in the System eventlog.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Jim Schwartz 41 Reputation points

2024-08-30T16:07:56.5766667+00:00

I thought Remote Desktop was the only way to access my computer remotely. What is the other option(s) and how do I turn them off? Sorry for so many questions

Andreas Baumgarten 111.3K Reputation points MVP

2024-08-30T16:42:02.3833333+00:00

Hi @Jim Schwartz ,

you can access a Windows Computer via network. This requires authentication with a valid user and password.

There are lot of options to access beside RDP:

File access via shares (including admin shares)

Remote Registry Access

Telnet (if you have a telnet server running on the computer)

Remote sessions via PowerShell

Remote management tools

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Jim Schwartz 41 Reputation points

2024-08-30T20:03:35.3433333+00:00

Ok. thanks. You can close this now.

Andreas Baumgarten 111.3K Reputation points MVP

2024-08-30T20:29:01.1433333+00:00

Hi @Jim Schwartz ,

if there are no additional questions to this topic please mark the answer with "Accept as answer". Only the thread starter is able to do this.

This will help others to find answers in Q&A.

Regards

Andreas Baumgarten

Yanhong Liu 12,180 Reputation points Microsoft Vendor

2024-09-05T02:34:12.17+00:00

Hi Jim Schwartz,

We haven’t heard from you for a couple of days. Just checking in to see if you have got a chance to see the answer posted in resolving the issue.

Please don't forget to Accept as answer /Upvote if the reply is helpful.

Thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

I was hacked and I think by someone entering my apartment

0 additional answers

Your answer