spydisec · Sep 24, 2026 · Sep 24, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,7 @@ Releases are tagged `vX.Y.Z` and published with a zip and a SHA256 checksum.
 ### Added
 
 - 🖧 **SMB server guest logons and security events are collected.** The server side of insecure guest-logon auditing is now on too (event 3023), with the two server logs it can land in: SMBServer/Security (Microsoft's docs; also session authentication failures 551, access denied 1006/1007/1009, weak session keys 1906) and SMBServer/Operational (where current Windows 11 builds write 3023). Both logs are raised from 8 MB to 128 MB. Mapped on the Settings catalog and Group Policy pages and carried in the GPO pack. Windows 11 24H2 / Server 2025 and later.
+- 🖥️ **RDP logons are kept before the session starts.** Two RDP logs join the Core set: TerminalServices-RemoteConnectionManager/Operational (connections reaching the listener, 261, and successful authentication with user and source address, 1149) and RemoteDesktopServices-RdpCoreTS/Operational (connections accepted, 131, and failed on a bad user name or password, 140, the RDP brute-force signal). Both are on by default at only 1 MB, so they wrap within hours on an exposed host; now 128 MB.
 
 ### Fixed
 

diff --git a/WinLogKit.Settings.ps1 b/WinLogKit.Settings.ps1
@@ -197,6 +197,17 @@ $script:BaselineChannels = @(
        Categories = @('Remote access')
        Purpose = 'RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.' }
 
+    # Kit additions: the two RDP logs before the session starts. Both are on
+    # by default at 1 MB, so they wrap within hours on an exposed host.
+    # Event IDs as their providers define them.
+    @{ Name = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'; TargetBytes = $mb128; MustEnable = $true;  Tier = 'Core'; DefaultSize = '1 MB'; MayBeAbsent = $true
+       Categories = @('Remote access','Authentication')
+       Purpose = 'RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.' }
+
+    @{ Name = 'Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational';          TargetBytes = $mb128; MustEnable = $true;  Tier = 'Core'; DefaultSize = '1 MB'; MayBeAbsent = $true
+       Categories = @('Remote access','Authentication')
+       Purpose = 'RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.' }
+
     @{ Name = 'Microsoft-Windows-TaskScheduler/Operational';                            TargetBytes = $mb128; MustEnable = $true;  Tier = 'Core'; DefaultSize = '1 MB'
        Categories = @('Scheduled and automated tasks','Persistence')
        Purpose = 'Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.' }

diff --git a/docs/gpo-paths.md b/docs/gpo-paths.md
@@ -129,6 +129,8 @@ Things to know before you start:
 | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Log | No Group Policy template for this log's size or enablement. |
 | Microsoft-Windows-WMI-Activity/Operational | Log | No Group Policy template for this log's size. |
 | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Log | No Group Policy template for this log's size. |
+| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Log | No Group Policy template for this log's size or enablement. |
+| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Log | No Group Policy template for this log's size or enablement. |
 | Microsoft-Windows-TaskScheduler/Operational | Log | No Group Policy template for this log's size or enablement. |
 | Microsoft-Windows-SMBServer/Audit | Log | No Group Policy template for this log's size. |
 | Microsoft-Windows-SmbClient/Audit | Log | No Group Policy template for this log's size. |

diff --git a/docs/intune-csp.md b/docs/intune-csp.md
@@ -129,6 +129,8 @@ domain-joined hosts, see [Group Policy paths](gpo-paths.md)).
 | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Log | No CSP for this log's size or enablement. |
 | Microsoft-Windows-WMI-Activity/Operational | Log | No CSP for this log's size. |
 | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Log | No CSP for this log's size. |
+| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Log | No CSP for this log's size or enablement. |
+| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Log | No CSP for this log's size or enablement. |
 | Microsoft-Windows-TaskScheduler/Operational | Log | No CSP for this log's size or enablement. |
 | Microsoft-Windows-SMBServer/Audit | Log | No CSP for this log's size. |
 | Microsoft-Windows-SmbClient/Audit | Log | No CSP for this log's size. |

diff --git a/docs/reference.md b/docs/reference.md
@@ -54,6 +54,8 @@ Reading the columns:
 | Microsoft-Windows-DriverFrameworks-UserMode/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: |
 | Microsoft-Windows-WMI-Activity/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: |
 | Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: |
+| Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational | Channel | 261, 1149 | 1 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: |
+| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational | Channel | 131, 140 | 1 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: |
 | Microsoft-Windows-TaskScheduler/Operational | Channel | - | 1 MB -> 128 MB | Low | Y | :material-check: | :material-check: | :material-check: |
 | Microsoft-Windows-SMBServer/Audit | Channel | 3021, 3022 | 8 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: |
 | Microsoft-Windows-SmbClient/Audit | Channel | 31998, 31999, 31997 | 8 MB -> 128 MB | Low | - | :material-check: | :material-check: | :material-check: |

diff --git a/presets/ASD.csv b/presets/ASD.csv
@@ -23,6 +23,8 @@
 "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","N","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices"
 "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","N","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks"
 "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","N","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access"
+"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","N","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication"
+"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","N","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication"
 "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","N","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence"
 "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","N","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions"
 "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","N","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions"

diff --git a/presets/DomainController.csv b/presets/DomainController.csv
@@ -23,6 +23,8 @@
 "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices"
 "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks"
 "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access"
+"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication"
+"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication"
 "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence"
 "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions"
 "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions"

diff --git a/presets/MemberServer.csv b/presets/MemberServer.csv
@@ -23,6 +23,8 @@
 "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices"
 "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks"
 "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access"
+"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication"
+"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication"
 "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence"
 "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions"
 "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions"

diff --git a/presets/Workstation.csv b/presets/Workstation.csv
@@ -23,6 +23,8 @@
 "Channel","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Microsoft-Windows-DriverFrameworks-UserMode/Operational","Core","All","Y","Y","","USB device plug/unplug detail. DISABLED by default so must be enabled.","Removable and external devices"
 "Channel","Microsoft-Windows-WMI-Activity/Operational","Microsoft-Windows-WMI-Activity/Operational","Core","All","Y","Y","","WMI operations. WMI event subscriptions are a common fileless persistence mechanism.","Execution; Persistence; Scheduled and automated tasks"
 "Channel","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Microsoft-Windows-TerminalServices-LocalSessionManager/Operational","Core","All","Y","Y","","RDP session connect/disconnect/reconnect (21/24/25) with source address - survives Security log clearing.","Remote access"
+"Channel","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","Core","All","Y","Y","","RDP connections reaching the listener (261) and successful network-level authentication with user and source address (1149), logged before any session or Security-log logon exists.","Remote access; Authentication"
+"Channel","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational","Core","All","Y","Y","","RDP transport: new connections accepted with the client address (131) and connections failed on a bad user name or password (140), the RDP brute-force signal.","Remote access; Authentication"
 "Channel","Microsoft-Windows-TaskScheduler/Operational","Microsoft-Windows-TaskScheduler/Operational","Core","All","Y","Y","","Task registration, updates and execution. DISABLED by default so must be enabled. Tasks are a top persistence mechanism.","Scheduled and automated tasks; Persistence"
 "Channel","Microsoft-Windows-SMBServer/Audit","Microsoft-Windows-SMBServer/Audit","Core","All","Y","Y","","SMB server audit events, including signing/encryption capability auditing on Windows 11 24H2 / Server 2025 and later (3021/3022) - identifies clients that cannot do SMB signing or encryption before you enforce it.","Remote access; Network flow and sessions"
 "Channel","Microsoft-Windows-SmbClient/Audit","Microsoft-Windows-SmbClient/Audit","Core","All","Y","Y","","SMB client audit events, including signing/encryption capability auditing (31998/31999) and insecure guest logons (31997) on Windows 11 24H2 / Server 2025 and later, and NTLM-blocking diagnostics.","Remote access; Network flow and sessions"

diff --git a/tools/Export-ReferenceTable.ps1 b/tools/Export-ReferenceTable.ps1
@@ -72,15 +72,17 @@ function Get-PurposeEventText {
 }
 
 # Kit-added items that Yamato's own scripts do not contain: the SMB
-# auditing (all SmbAudit rows plus its four channels), the NTLM audit
+# auditing (all SmbAudit rows plus its four channels), the two pre-session
+# RDP logs, the NTLM audit
 # registry values, the PowerShell 7 policy fallbacks (#44) and the forced
 # subcategory audit setting (#71). They must not
 # carry the Y letter. Situational items (the old Optional tier: IPsec Driver,
 # the DPAPI debug channel) are opt-in extras outside Yamato's set too,
 # whatever their tier.
 $yExcludedIds = @('NtlmOutboundAudit', 'NtlmInboundAudit', 'NtlmDomainAudit',
     'PS7ScriptBlock64', 'PS7ScriptBlock32', 'PS7ModuleLogging64', 'PS7ModuleLogging32', 'ForceSubcategoryAudit')
-$yExcludedChannels = @('Microsoft-Windows-SMBServer/Audit', 'Microsoft-Windows-SmbClient/Audit', 'Microsoft-Windows-SMBServer/Security', 'Microsoft-Windows-SMBServer/Operational')
+$yExcludedChannels = @('Microsoft-Windows-SMBServer/Audit', 'Microsoft-Windows-SmbClient/Audit', 'Microsoft-Windows-SMBServer/Security', 'Microsoft-Windows-SMBServer/Operational',
+    'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational', 'Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational')
 function Test-Situational {
     param([hashtable]$Item)
     return ($Item.ContainsKey('Situational') -and $Item.Situational)