Hello,
Thank you for your question and reaching out.
Logon refers to an RDP logon to the system, an event that appears after a user has been successfully authenticated. It is an event with the EventID 21 (Remote Desktop Services: Session logon succeeded). This events are located in the “Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager -> Operational”
You can get the list of events related to successful RDP authentication (EventID 4624) using this PowerShell command:
Get-EventLog security -after (Get-date -hour 0 -minute 0 -second 0) | ?{$.eventid -eq 4624 -and $.Message -match 'logon type:\s+(10)\s'} | Out-GridView
--If the reply is helpful, please Upvote and Accept as answer--