# RDP connection review card
Authored worksheet. Use only within approved scope; never reconnect to a suspicious destination for evidence.

## Employee pause and report
- Was this connection expected through the normal workflow?
- What remote computer address and publisher are shown? Verify through an established contact route.
- Which local resources are requested and selected? Leave unnecessary resources unselected.
- If unexpected, cancel and report the original message, approximate time, destination shown, and actions already taken.
- Do not include passwords, codes, or usable credentials in the report.

## Administrator evidence record
- Owner, authorization, test window, permitted destination:
- Actual client, OS, update level, launch method, relevant policy:
- Harmless marker and isolated test device; no production resources:
- Approved operation and expected result; prohibited actions:
- Message reference; warning and selections; connection evidence:
- Resource result: refused / unavailable / content returned / unresolved:
- Correlated evidence reference; collection gaps:
- Positive control separately authorized and recorded:
- Cleanup owner, result, exceptions:
- Fix, unchanged retest conditions, result:

Connection attempts, completed sessions, resource availability, and content reads are separate observations.