I noticed that my uplink bandwidth during a speed test seemed reduced, so I started investigating my network activity with Resource Monitor. I found that svchost.exe was transmitting ~2kB/sec (~16kb/s) to, reportedly Illinois Century Network, a backbone provider in Springfield, IL.

With process explorer I discovered that this svchost.exe PID was tied to an RDP session while I was logged in locally. I disabled remote desktop access and the process using the bandwidth immediately died. Of course my RDP port is open to the world, by design, so that I can access it away from home.

It appears clear to me that there were unauthorized attempts to access my PC remotely. How can I determine whether or not an RDP login attempt was successful?

I've checked in the TerminalServices-RemoteConnectionManager Operational logs and I can see what appears to be a smattering of common user names: "forms", "cecilia", "voicemail", "diane", etc. None of those accounts exist on my machine. Here's a sample entry:

Remote Desktop Services: User authentication succeeded:

User: diane
Source Network Address:


In the meantime, I've disabled remote desktop access. If I choose to restore it, I'll likely change the default port number at minimum. Anyone know how easy that would be to defeat via port scanning? A more secure method would be setting up SSH tunneling, though the Microsoft Android RDP client app doesn't support this.

  • 1
    Related: serverfault.com/questions/461396/…
    – deviantfan
    Nov 17, 2016 at 3:27
  • 2
    20 kbps isn't a lot; are you sure someone was logged in, and not just trying to log in a bunch of times? I'd check the Security log for remote logon events to see if someone actually succeeded or not, and what account they got in with, if any. Nov 17, 2016 at 4:04
  • @ReidRankin thanks very much for the clue. You were absolutely right about it likely being attempted intrusions rather than successful ones. See the edits to my question. Note though that the "Security" log is not the place to identify attempted RDP logins. They are found in TerminalServices-RemoteConnectionManager Operational logs. Also, not that it makes a big difference, but the bandwidth was 20kB/s (160kb/s) not 20kb/s. Nov 17, 2016 at 15:35

1 Answer 1


Non-server editions of Windows only allow one user to be logged in at a time, so a successful login via RDP will kick you out and you will probably notice.

You can also find successful RDP login in the Security event logs by looking at the logon type. It is possible to use an XPath filter for this.

The bandwidth usage you're seeing is probably RDP serving the login screen. You can change the settings to require Network Level Authentication which validates the credentials before a connection can be made (no login screen).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .