While reviewing Windows RDP event logs for the RDP project [https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/] , I noticed one in particular. Windows Event ID 1029 can be found under Microsoft-Windows-TerminalServices-RDPClient/Operational.evtx. This event is created o…