Determine All User Login Events for the Microsoft RDP Application in Okta
Last Updated:
Administration
Okta Classic Engine
Okta Identity Engine
Overview
Querying the System Log with the raw user agent and verify event type determines all user login events for the Microsoft Remote Desktop Protocol (RDP) application. A standard System Log query using the target ID and authentication event type displays user login events for Short Message Service (SMS) or soft token factors, but omits Okta Verify push events.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft Remote Desktop Protocol (RDP)
- Multi-Factor Authentication (MFA) Application
- Okta MFA Credential Provider for Windows Agent
- System Log
Solution
What steps determine all user login events for the Microsoft RDP application?
Execute a specific System Log query for the raw user agent, review the event details for the server information, and download the results as a Comma Separated Values file.
- Enter the following query in the System Log:
client.userAgent.rawUserAgent co "OktaRDPAgent" and eventType eq "user.authentication.verify"- Review the RawUserAgent field in the System Log event to identify the server information.
- Download the System Log results as a Comma Separated Values (CSV) file.
- Locate the server information in the client.user_agent.raw_user_agent column of the CSV file.
