RDP Startup Programs
Programs started inside each Remote Desktop session when it connects.
Use it to find a program added to run in every Remote Desktop session as it connects, beside rdpclip.
- SYSTEM
- Persistence
What It Proves
The StartupPrograms value lists programs Windows runs in a Remote Desktop session at connect. Adding a program here runs it for anyone who connects over RDP.
What It Does Not Prove
The default is rdpclip, so any other program is the signal. It runs on RDP connection, so it only fires when someone connects.
Where It Lives
RDP Startup Programs lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| StartupPrograms holds only rdpclip, the default clipboard helper in an RDP session. A program beyond rdpclip is the signal. |
| The RDP-Tcp InitialProgram is empty, so no program is forced on connect. A value here would run for anyone who connects over RDP. |
How to Read It
Read StartupPrograms under Wds rdpwd, where the default is rdpclip. Check InitialProgram under WinStations RDP-Tcp for a forced program as well. A program other than rdpclip, or a path outside System32, is the red flag.
- When Windows Writes It
- When the value is changed, usually with admin rights.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records these first. A hit does not show that anyone has connected since.
// Changes to the RDP StartupPrograms valueDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what RDP Startup Programs shows.
- AmcacheGives the SHA-1 of the listed program.
- RDP Logon, Security Event 4624 Type 10Not in the RegistryShows who connected over RDP, the moment the listed programs run.
- Program Starts in Session, Security Event 4688Not in the RegistryShows the listed program starting in the new RDP session.
Sources
The facts on this page come from these public pages, which say more on each point.