Remote Desktop Protocol extension
- Latest Dynatrace
- Extension
- Published Oct 27, 2025
Gather metrics and gain insights into the performance of user sessions over RDP.
Get started
Overview
The Microsoft Remote Desktop Protocol (RDP) provides remote display and input capabilities over network connections for Windows-based applications running on a server. RDP is designed to support different types of network topologies and multiple LAN protocols. RDP also forms the basis for enterprise level solutions like Azure Virtual Desktop (formerly Windows Virtual Desktop), a desktop and app virtualization service that runs on the cloud.
This extension is designed to run on RDP session hosts, alongside the OneAgent. It leverages Windows Event Logs and Performance Counters to gather details about ongoing RDP sessions, providing insights into sessions performance as well as the health of the session host. The data gathered is represented in Dynatrace as Real User Monitoring (RUM) Sessions and Actions, or Metrics.
This is intended for users who:
- Manage the infrastructure responsible for delivering virtual desktops to their users over RDP
- Want to understand the performance of the RDP protocol and health of their session hosts
- Need insights into the dynamics of user activity in remote desktop environments
This extension enables you to:
- Track basic RDP activity for users across different session hosts
- Monitor the Network and Graphics performance of the RDP protocol on session hosts
- Correlate poor user experience with insufficiencies in client, server, or network resources
Use cases
- Network Performance - is the user accessing the remote host over a slow network? does the client have enough bandwidth? is the session host skipping frames due to network insufficiencies?
- Graphics Performance - what is the frame quality of the user's session? does the session host skip frames due to network, client, or server insufficiencies? is frame encoding taking the appropriate amount of time?
- Input Delays - is the RDP kernel registering delays from when the user interacted with an application until the application reacted to that input?
- Capacity - are active users being impacted by large amounts of inactive sessions holding resources on the host? is your session host clearing these appropriately?
- Security - is there a large amount of failed logins to the hosts? what are the accounts that result in auhtentication failures, and for what reason?
Requiremenets
Install OneAgent
Install OneAgent on your session hosts. Infrastructure-only mode is sufficient for this extension to function correctly.
Enable access to Windows Event Logs on Windows hosts
The extension requires access to programmatically read Windows Event Logs.
-
Enableg access for Operational logs is done through the Windows registry. Navigate to the
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLoglocation using a tool likeregeditand ensure the following keys are present:Microsoft-Windows-TerminalServices-RemoteConnectionManager/OperationalMicrosoft-Windows-TerminalServices-LocalSessionManager/OperationalMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/OperationalMicrosoft-Windows-RemoteDesktopServices-RdpCoreCDV/Operational
The name of the key (folder) must be exactly like in the above list. It does not represent nested folders.
-
Enabling access for the Security log is done for individual accounts (using SID notation). This is most easily done using the
wevtutilcommand. Run the following command from a terminal:wevtutil sl Security "/ca:O:BAG:SYD:(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-11)"This enables read access to the log for the Authenticated Users (S-1-5-11), Network Service (S-1-5-20), and Event Log Readers (S-1-5-32-573) accounts.
Compatibility information
Minimum supported OneAgent version: 1.280
Supported RDP clients:
- Direct RDP connections (mstsc.exe)
- Microsoft Remote Desktop App (older than October 2022 release)
Session Input Delay and Process Input Delay are only supported for Windows Server 2019, or Windows 10 (1809), or later.
Activation and setup
After adding the extension to your environment, its monitoring configuration offers a few options for configuring its behavior, specifically around Real User Monitoring.
If the extension should create User Sessions and Actions, you must enable Report RUM data. Once this is enabled, the following options appear:
Application ID- the ID of a Custom Application for reporting the collected dataDetect Beacon URL- If enabled, the extension will attempt to read the OneAgent configuration files and detect a suitable URL for initializing the OpenKit framework and sending the RUM data through it.
- If disabled, you must specify the RUM Beacon URL using the
Beacon URLfield.
Reduce DEM consumption- for long running sessions (> 30 min.), this option will reduce the amount of "Network Performance", "Graphics Performance", and "Session Input Delay" user actions (normally reported every minute) in order to reduce the amount of licenses utilized (1 session is consumed every 200 actions).
Opting in/out for metrics is done through the extension's feature sets, which are seen on the last step of the configuration process.
FAQ
After following the setup instructions, you can run the get-eventlog -List command from a Powershell terminal. The output will list all logs log available for reading in an output similar to this:
Max(K) Retain OverflowAction Entries Log------ ------ -------------- ------- ---20,480 0 OverwriteAsNeeded 136 Application512 7 OverwriteOlder 0 Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV/Operational512 7 OverwriteOlder 334 Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational512 7 OverwriteOlder 55 Microsoft-Windows-TerminalServices-LocalSessionManager/Operational512 7 OverwriteOlder 85 Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational20,480 0 OverwriteAsNeeded 769 Security20,480 0 OverwriteAsNeeded 1,026 System
Ensure that all logs are listed in the Log column, and all of them have a value greater than zero
in the Entries column.
After creating a Custom Application, open its detail page, click the ... button, then select Edit. On the page that opens, navigate to Instrumentation wizard and find these details listed as Application ID and Beacon URL
While we noticed it happen particularly with Session and Process Input Delay performance counters, it is a known issue that Microsoft Performance Counters may break and require rebuilding.
Following Microsoft's guide, run the following commands as Administrator:
lodctr /RWINMGMT.EXE /RESYNCPERFGet-Service -Name "pla" | Restart-Service -VerboseGet-Service -Name "winmgmt" | Restart-Service -Force -Verbose
Feature sets
When activating your extension using monitoring configuration, you can limit monitoring to one of the feature sets. To work properly the extension has to collect at least one metric after the activation.
In highly segmented networks, feature sets can reflect the segments of your environment. Then, when you create a monitoring configuration, you can select a feature set and a corresponding ActiveGate group that can connect to this particular segment.
All metrics that aren't categorized into any feature set are considered to be the default and are always reported.
A metric inherits the feature set of a subgroup, which in turn inherits the feature set of a group. Also, the feature set defined on the metric level overrides the feature set defined on the subgroup level, which in turn overrides the feature set defined on the group level.
| Metric name | Metric key | Description |
|---|---|---|
| Session input delay | rdp.session_input_delay | The longest time it takes for an input (user click/keypress) to reach the application inside an RDP session. The value is reported per session. |
| Process input delay | rdp.process_input_delay | The longest time it takes for an input (user click/keypress) to reach the application inside an RDP session. The value is reported per process. |
| Metric name | Metric key | Description |
|---|---|---|
| Active sessions | rdp.terminal.active_sessions | The number of Active RDP Sessions on the host. Active Sessions are actively being used by users logged onto their Virtual Desktop. |
| Inactive sessions | rdp.terminal.inactive_sessions | The number of Inactive RDP Sessions on the host. Inactive Sessions are not currently being used by users but have not been terminated, users still being able to resume. |
| Active users | rdp.terminal.active_users | The number of Active Users on the RDP Host. Active Users are actively logged onto their Virutal Desktops. |
| Login failures | rdp.terminal.login_failures_count | The number of failed login attempts along with failure details. |
| Metric name | Metric key | Description |
|---|---|---|
| Total sessions | rdp.terminal.total_sessions | The total number of RDP Sessions on the host. This includes both active and inactive sessions. |
| Metric name | Metric key | Description |
|---|---|---|
| Base TCP RTT | rdp.network.base_tcp_rtt | Base TCP round-trip time (RTT) detected in milliseconds |
| Base UDP RTT | rdp.network.base_udp_rtt | Base UDP round-trip time (RTT) detected in milliseconds |
| Current TCP RTT | rdp.network.current_tcp_rtt | Current TCP round-trip time (RTT) detected in milliseconds |
| Current UDP RTT | rdp.network.current_udp_rtt | Current UDP round-trip time (RTT) detected in milliseconds |
| TCP bandwidth | rdp.network.tcp_bandwidth | Current TCP bandwidth detected in bits per second (bps) |
| UDP bandwidth | rdp.network.udp_bandwidth | Current UDP bandwidth detected in bits per second (bps) |
| Loss rate | rdp.network.loss_rate | The number of packets lost in transmission, expressed as a percentage of all packets. |
| Retransmission rate | rdp.network.retransmission_rate | The number of packets retransmitted due to loss or damage, expressed as a percentage of all packets |
| Metric name | Metric key | Description |
|---|---|---|
| Encoding time | rdp.graphics.encoding_time | The average time spent encoding frames. For RDP encoding time should be under 33 milliseconds. |
| Frame quality | rdp.graphics.frame_quality | The quality of the output frame represented as a percentage of the quality of the source frame. |
| Frames skipped (client) | rdp.graphics.frames_skipped_client | The number of frames skipped per second due to insufficient client resources |
| Frames skipped (network) | rdp.graphics.frames_skipped_network | The number of frames skipped per second due to insufficient network resources |
| Frames skipped (server) | rdp.graphics.frames_skipped_server | The number of frames skipped per second due to insufficient server resources |
