Windows registry artifactTerminal Server Client (RDP)
Displays the IP addresses/hostnames of devices this system has connected to (Outbound RDP)
- User Activity
- 1 key
NTUSER
Registry keys
1 key that RECmd reads for this artifact
NTUSERSoftware\Microsoft\Terminal Server ClientDisplays the IP addresses/hostnames of devices this system has connected to (Outbound RDP)
References
5 links
- github.comTerminalServerClient plugin(opens in new tab)
- jpcertcc.github.io/ToolAnalysisResultSheet/details/mstsc.htm(opens in new tab)
- docs.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer(opens in new tab)
- cyberfox.blog/tag/rdp-mru/(opens in new tab)
- ir3e.com/chapter-14-other-applications/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)