We often want to audit user logins from Remote Desktop Gateway to see what kind of activity a particular user has when connecting to remote terminal servers.
The simplest way is to execute the following powershell script on the RD Gateway server(s):
(Get-WinEvent -FilterHashTable @{LogName='Microsoft-Windows-TerminalServices-Gateway/Operational';ID='302'} | Select-Object -Property TimeCreated,Message) -match '[USERNAME YOU ARE LOOKINGFOR]' | Format-Table -AutoSize
This will search the Event log at Microsoft/Windows TerminalServices/Gateway/Opertional for Event ID 302 (login), then will run a match for the username you specify.
The output will show the time as well as the public IP of the user that connected!