Filter Windows Event Viewer Security Logs for Remote Desktop Logon Type 10
There is no available field to filter the Windows Event VIewer Security Logs for users logging in with RDP (logon type 10). Use the XML table and check the box ‘Edit query manually’. Copy/paste the XML code to find all users who have logged in by remote desktop: