How to Tell If a Windows 11 PC Was Remotely Accessed

Start With the Right Question

"Was someone remotely on my PC" splits into three separate investigations, because the three common access paths log to entirely different places:

1. Windows RDP — logged natively, in detail, in the Windows event log.
2. A remote support tool (TeamViewer, AnyDesk, QuickAssist) — logged by the tool, in its own files.
3. Malware with remote access capability — logs nothing deliberately, so you work from the artifacts it could not avoid leaving.

Work through them in that order. Most cases resolve in the first two.

This is the analysis half. If you already know a scam caller had access and you need to secure the machine, start with what to do after a remote access scam instead.

Part 1: Windows RDP

Step 1: Check whether RDP was even enabled

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections

0x1 means RDP is disabled. 0x0 means it is on. On Windows 11 Home, RDP hosting is not available at all, which narrows the investigation immediately.

If it is enabled and the owner does not know why, that is a finding on its own — enabling it requires administrator rights.

Step 2: Read the RDP-specific operational log

Event Viewer → Applications and Services Logs → Microsoft → Windows → TerminalServices-LocalSessionManager → Operational.

The event IDs that matter:

| ID | Meaning | |---|---| | 21 | Session logon succeeded — includes the source network address | | 22 | Shell start notification | | 23 | Session logoff | | 24 | Session disconnected — includes source address | | 25 | Session reconnection |

Event 21 and 25 are the ones to read first: both carry the source IP in the event data. An address outside your local subnet on a home machine means the connection came from the internet.

Also check TerminalServices-RemoteConnectionManager → Operational, event ID 1149, which records the user name and source IP of connection attempts — including ones that then failed authentication. A run of 1149 events from unfamiliar addresses is the signature of an exposed RDP port being brute-forced.

Step 3: Correlate against Security log logons

Security log, event ID 4624, filtered to Logon Type 10 (RemoteInteractive — that is RDP) and Type 7 (unlock/reconnect).

Each 4624 gives you the account name, the source network address, and the logon time. Match these against the type 21 events from the previous step — they should agree. Where they do not, trust the Security log and ask why.

Failed attempts are event 4625, same log. High volume of 4625 from one address, followed by a single 4624, is a successful brute force and needs treating as a confirmed compromise.

Full detail on reading these: Event ID 4624 and logon types.

Part 2: Remote Support Tools

These log to their own files, and the files survive uninstalling the application in most cases.

Step 4: TeamViewer

C:\Program Files\TeamViewer\Connections_incoming.txt
C:\Program Files (x86)\TeamViewer\Connections_incoming.txt
%APPDATA%\TeamViewer\Connections.txt

Connections_incoming.txt is the important one: it is a plain-text list of sessions into this machine, with the remote TeamViewer ID, the display name of the connecting party, start and end times, and the local user account. One line per session.

The connecting ID is the single most useful piece of evidence a scam victim can produce.

Step 5: AnyDesk

%APPDATA%\AnyDesk\connection_trace.txt
%PROGRAMDATA%\AnyDesk\connection_trace.txt
%APPDATA%\AnyDesk\ad.trace

connection_trace.txt lists incoming sessions with timestamp, direction, and the remote AnyDesk ID. ad.trace is verbose application logging and is worth reading when the trace file has been cleared — it frequently still contains the session detail.

Step 6: Quick Assist and Remote Assistance

Microsoft Quick Assist does not keep an equivalent connection log. Look instead for its execution in Prefetch — QUICKASSIST.EXE-<hash>.pf with a run count and timestamps — and in the Application event log around the same window.

Part 3: When Nothing Logged It

If RDP was off and no support tool is installed, but the concern remains, fall back to artifacts that record consequences rather than connections:

• Logon events — 4624 with Logon Type 3 (network) or 10, at times the owner was not using the machine.
• Persistence mechanisms — most remote access malware needs to survive reboots, and that is loud.
• SRUM — sustained network volume from an unexpected process.
• The firewall log — inbound allows on unusual ports, if logging was on.
• New local accounts — Security log event 4720, user account created. Attackers add accounts far more often than people expect.

Building the Timeline

Convert everything to one timezone before you assemble it. TeamViewer logs in local time; the Windows event log stores UTC and Event Viewer displays local. Mixing the two invents gaps that were never there.

Then read the sequence, not the individual events. A logon at 02:14, a scheduled task created at 02:16, and an outbound transfer starting 02:19 is a narrative. Any one of those alone is not.

Related

• Event ID 4624 and logon types
• 30-minute triage of a suspected-compromised PC
• Consumer guides: after a remote access scam · securing RDP on Windows 11

FAQ

Does the TeamViewer log survive uninstalling TeamViewer?

Usually yes. Connections_incoming.txt sits in the installation directory and standard uninstallation frequently leaves it behind, as does the %APPDATA%\TeamViewer folder. Check both locations even when the application is no longer present — and check the Recycle Bin, since a caller in a hurry may have deleted rather than wiped it.

What logon type means someone used Remote Desktop?

Type 10, RemoteInteractive, in Security event 4624. Type 7 indicates an unlock or reconnection to an existing session, which also appears when an RDP session is resumed. Type 3 is a network logon — file share access rather than an interactive desktop — and is common and usually benign.

The event log only goes back a few days. Can I extend it?

Not retroactively. The Security log defaults to a size cap that fills quickly on an active machine. Going forward, raise the maximum log size in Event Viewer (right-click the log → Properties) to at least 512 MB, or forward events to another host. For the current investigation, work from artifacts with independent retention — Prefetch, SRUM, Amcache.

Is an unfamiliar IP in event 1149 proof of a break-in?

No. Event 1149 records connection attempts, including failed authentication. Unfamiliar addresses generating 1149 events mean the machine's RDP port is reachable from the internet and is being scanned, which is extremely common and not itself a compromise. It becomes a compromise when a successful 4624 with Logon Type 10 follows from the same address.