When press on those buttons with each user still not write me in logs and I guess I need to create the log, the issue is that I have multiple sessions running in same time with multiple users, one of them doing restart PC or shutdown PC without using terminal and they don't want to use terminal just those buttons. I need to know how to discover the user who did it. In the screenshots is just an example of what they do.
xrdp session:
tty7 session:
How can I know which user is doing manual power off and restarting the PC if part of the users is connected in multiple XRDP sessions and one of the users is connected to TTY7 sessions?