By default, VNC Server logs connections to the Windows Event Log. For every connection, the following information is logged:
Connection to [server-cloud-id] is from user <RealVNC-account-email>
Connected: <RealVNC-account-email> (from <IP:port>)
<Authentication-success | failure> <RealVNC-account-email> (from <IP:port>) as <Windows account user> (VNC Server permission)
Disconnected: <RealVNC-account-email> (from <IP:port>)(<disconnection-reason>)
To view this information:
- Open Event Viewer.
- Select Windows Logs > Application.
- Select Filter Current Log and choose VNC Server as the Event sources:
For more information on logging in general, and particularly about other platforms, visit: https://www.realvnc.com/en/connect/docs/logging.html#all-about-logging