Well, the problem with the event viewer is that you kinda have to know what you're looking for beforehand. I rarely use windows, so I don't know the convention

Well, the problem with the event viewer is that you kinda have to know what you're looking for beforehand. I rarely use windows, so I don't know the conventions (if there are any), but I remember one case of someone attempting a remote desktop connection that had an error along the lines of what I said: "Cannot connect". I've never found where the logs for the RDP client were. For servers, we dump the logs in Elasticsearch, so a naïve query will at least set me on the right track. I'm also not a particularly patient person, so the unbearable slowness of the event viewer's search function and the fact that I never know if I'm looking for Thing, Microsoft Thing, Windows Thing, or ThngSvc, I usually give up in frustration. And, again, had I had an event id or something, the Find in the event viewer might have been more helpful.