Email notification when user logs on via remote desktop

Adding an include filter (Step 3 of 7)

Including the event

To be notified when this event occurs we have to setup an include filter which matches this event and subsequently forwards it to an action.

You can manually create a filter by right-clicking an event log package, selecting "Add Filter" and then specifying the filter conditions. However, when looking to include specific events, such as RDP logons, EventSentry provides two quick alternatives to manually entering the event details.

After having located the event in the EventSentry event log viewer, right-click the event and select "Add Include Filter".

Or, when viewing the event details, simply click the Include icon as shown in the screenshot below: