Windows XP does not enable logging of most events by default.


To enable logging for RDP via registry


Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.You can enable Remote Access logging in the System log by adding a DWORD value in the Windows registry. To do this, follow these steps:

  1. Click Start, click Run, type regedit the Open box, and then click OK.
  2. Locate the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters Right-click the Parameters subkey, point to New, and then click DWORD Value.
  3. Type LoggingFlags as the name of the newly created DWORD value.
  4. Double-click LoggingFlags, type 2 or 3 in the Value data box, and then click OK.

    Note The maximum DWORD value here is 3.
  5. Quit Registry Editor.

    Note For these changes to take effect, you must restart your computer.
Remote Access logs will now appear in your System log.
https://support.microsoft.com/en-us/kb/894565

Also
You can setup an Audit Policy using the Group Policy editor to log logon success and failures. Go
to "Start -> Run" and type 'gpedit.msc' (without the quotes). Navigate to "Local Computer Policy ->
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit
Policies -> Audit logon events". Highlight and right-click and select properties. Configure as
desired. Note, some folks have XP boxes setup to login without a password. Logging in
without a password counts as a "failure". This results in the security log filling up very fast if
you log failures and have a user without a password
http://www.tomshardware.com/forum/145000-45-remote-desktop-connection-logs