Comment by Charles Burge on Filtering Security Logs by User and Logon Type

This is exactly what I needed to find out who connected to one of my servers via RDP. I just had to change the LogonType to '10' (and remove the bit about username).