2026-04-26T00:00:00 Administrator \Benachrichtigung bei RDP Anmeldung true <QueryList><Query Id="0" Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[Provider[@Name='Microsoft-Windows-TerminalServices-RemoteConnectionManager'] and EventID=1149]]</Select></Query></QueryList> S-1-5-18 LeastPrivilege IgnoreNew false true true false false true false true true false false false true false PT72H 7 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\scripts\rdp-login-notifier\rdp-access-notification.ps1"