Good morning,
Looking on TerminalServices-LocalSessionManager\Operational i found strange messages. That i would like to understand to be sure to have no security issues.
About every time the machine is switched on and sometimes during is working time i see this messages: (oldest to newest)
time:10/12/2016 9:49:16 AM
Event Id:41
Message:
Begin session arbitration:
User: CURRENTUSERNAME
Session ID: 27
Event Id:42
Message:
End session arbitration:
User: CURRENTUSERNAME
Session ID: 27
time:10/12/2016 9:49:17 AM
Event Id:21
Message:
Remote Desktop Services: Session logon succeeded:
User: CURRENTUSERNAME
Session ID: 27
Source Network Address: LOCALE
Event Id:22
Message:
Remote Desktop Services: Shell start notification received:
Session ID: 27
Source Network Address: LOCALE
I see this messages when remote desktop was not used.
This is a Win10 pc with anniversary update. Does it should be somethin related to the new "remote assistance functionality"?
Is there anyone that can help me to better understand what's the reason of this messages?
thank you very much.