By default, RealVNC Server logs all connections to the Windows Event Log. For every connection, the following information is logged:
Connection to [server-cloud-id] is from user <RealVNC-account-email>
Connected: <RealVNC-account-email> (from <IP:port>)
<Authentication-success | failure> <RealVNC-account-email> (from <IP:port>) as <Windows account user> (RealVNC Server permission)
Disconnected: <RealVNC-account-email> (from <IP:port>)(<disconnection-reason>)
To view this information:
- Open Event Viewer.
- Select Windows Logs > Application.
- Select Filter Current Log and choose VNC Server as the Event sources:
For more information on logging in general, and particularly about other platforms, visit: All About Logging
For information about storing logs centrally, please see Centralised logging for VNC Server