Terminal Server Client (Outbound RDP)
Hosts this user reached with Remote Desktop, and the user name they used for each.
Use it to see which hosts a user reached with Remote Desktop, and the account they used for each.
- NTUSER.DAT
- Accounts and RDP
What It Is
This key, under Terminal Server Client, is where the Remote Desktop client records the hosts a user has connected out to, so it can offer them again. It names each host the user reached and, under each, the account name they last typed for it. It shows the client side of a Remote Desktop session, the machine the connection started from. It lives in the user's own NTUSER.DAT.
What It Proves
The user ran the Remote Desktop client against that host, and UsernameHint shows the account they connected as.
What It Does Not Prove
It shows the client side only, because the logon itself happened on the target. Users can clear the list, and only the Default value keeps an order.
Where It Lives
Terminal Server Client (Outbound RDP) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| srv-fin-01 is the last host alice reached with Remote Desktop. The logon itself happened there, so check that server's own logs. |
| Before that, alice connected to 192 |
| alice connected to srv-fin-01 as CORP\ |
How to Read It
Default holds MRU0 to MRU9, the last ten hosts, with MRU0 the newest. Servers has a subkey per host ever reached, with UsernameHint and the server certificate hash. Each Servers subkey last write time usually marks the last connection to that host.
- When Windows Writes It
- When the user connects with the Remote Desktop client (mstsc.exe).
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (tsclient)
Hunt It
The hosts a user connected out to sit in this per-user key, so parse NTUSER.DAT, or read it live with Velociraptor. The target machine's own Security log records the matching sign-in in event 4624 with logon type 10.
Shows each connection with its target and time. It does not read the saved host list or user name hints.
// Outbound RDP connections made by the Remote Desktop clientDeviceNetworkEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Terminal Server Client (Outbound RDP) shows.
- RunMRUCan show mstsc typed into the Run box, sometimes with the host name.
- RDP Client Log, TerminalServices-RDPClient Event 1024Not in the RegistryRecords each connection attempt with the host and time, even after the list is cleared.
- Explicit Credentials, Security Event 4648Not in the RegistryNames the account and server for a connection made with typed credentials, and when.
Sources
The facts on this page come from these public pages, which say more on each point.