Terminal Server Client Registry (RDP History)

Location

Description

Per-user registry keys recording the hostname or IP address of every RDP server the user connected to from this machine, along with the username hint used for each connection.

Forensic Value

This artifact maps the outbound RDP connection history for each user account, revealing the lateral movement path from the attacker perspective. Each subkey under Servers represents a destination host with a UsernameHint value showing the account name used to authenticate. The Default\MRU list records the order of most recently connected servers. This complements the inbound RDP event logs on destination machines and is critical for reconstructing lateral movement chains.

Tools Required