Hacked? RDP logs on Windows 11 Home edition

[Toothpaste67]

A few days ago, I decided to check Event Viewer Logs after noticing a few oddities with my PC. I have Windows 11 Home Edition installed, so RDP should be disabled by default. Yet I found hundreds of events logged in the Terminal Service Local Session Manager Operational Logs. The events had the EventIDs 21, 22, 23, 24, 34, 39, 40, 41, 42, 54 (and probably some more). There were multiple Events logged each day, yet I never used RDP once, and as I've previously mentioned, I have Windows 11 Home Edition installed. I did a clean reset not that long ago, so now I'm suspecting that I was hacked, the

Continue reading...