This is also a good time to remind everyone that this series is intended to denote a combination of logs that, when culled together and analyzed as a whole, can help indicate and track RDP logon history for a target. It was purposefully put together this way as Windows can be extremely ambiguous, unreliable, and downright initially confusing in what it logs (or does not).