RDP Forensics Cheat Sheet

What it is

Remote Desktop Protocol (RDP) sessions leave traces on both ends. On the target (the machine being connected to), several event log channels record the network connection, the authentication and the session lifecycle. On the source (the machine the user connected from), the Remote Desktop client (mstsc.exe) keeps a history of servers and user names, and its own client log. Together they are the main evidence of interactive lateral movement.

Location

Target side (event logs in C:\Windows\System32\winevt\Logs\):

Channel	Events
`Security`	4624 (logon type 10, or 7 on reconnect/unlock), 4625, 4634/4647, 4778 (session reconnected), 4779 (session disconnected)
`Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational`	1149: user authentication succeeded for a network connection (user, domain, source IP)
`Microsoft-Windows-TerminalServices-LocalSessionManager/Operational`	21 logon, 22 shell start, 23 logoff, 24 disconnected, 25 reconnected (each with source address)
`Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational`	131: server accepted a new TCP connection (client IP and port)

Source side:

Location	Content
`NTUSER.DAT\Software\Microsoft\Terminal Server Client\Default`	`MRU0`…`MRU9`: recent servers typed in the client
`NTUSER.DAT\Software\Microsoft\Terminal Server Client\Servers\<host>`	`UsernameHint` (account used), `CertHash`
`C:\Users\<user>\Documents\Default.rdp` (hidden)	Settings of the last connection, including `full address`
`Microsoft-Windows-TerminalServices-RDPClient/Operational`	1024: client trying to connect to a server; 1102: client initiated a multi-transport connection to an IP
`%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\`	RDP bitmap cache

What it proves

Target side: an account authenticated over RDP from a source IP at a given time, and how long the session lasted (logon → disconnect/logoff).
Source side: a user of this machine connected (or tried to connect) to these hosts, with which account name.
1149 alone proves successful authentication of a network connection, not a full interactive logon; confirm with 4624 type 10 and LocalSessionManager 21/22.

Key fields

Field	Where	Meaning
`LogonType`	4624	10 = RemoteInteractive; 7 = unlock/reconnect (logon types)
`IpAddress`, `WorkstationName`	4624 / 4625	Source of the connection (workstation name is the client's NetBIOS name)
`TargetLogonId`	4624	Links the logon to later events of the same session
`User`, `Session ID`, `Source Network Address`	LocalSessionManager 21–25	Session lifecycle per user
`UsernameHint`	Servers key	Account the user typed for that host

Timestamps

Timestamp	Set when	Format	Pitfalls
Event `SystemTime`	Event logged	UTC	Viewers show local time; normalize before correlation
`Servers\<host>` key LastWrite	First connection or settings change for that host	FILETIME, UTC	Not updated on every connection
`Default` key LastWrite	MRU list updated	FILETIME, UTC	Dates only the most recent `MRU0`
`Default.rdp` $SI modification	Client saved its last settings	NTFS, UTC	Last connection only

Retention and clearing

The RDP-related Operational channels are small and roll over on busy servers; Security may roll even faster.
Users can remove servers from the client's history, which deletes the MRU value and the Servers subkey; Default.rdp, the RDPClient log and the bitmap cache may still remain.
Clearing logs produces 1102 / 104; check SIEM copies and shadow copies.

Collection

KAPE target: EventLogs-RDP (Security, System and the RDP channels) and RegistryHivesUser for the client keys; RDPCache and RDPLogs exist for related files.
Velociraptor (Windows.Triage.Targets): EventLogs-RDP and RegistryHivesUser; Windows.EventLogs.RDPAuth and Windows.Registry.RDP parse them live.
Built-in:

Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object Id -in 21,22,23,24,25
Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' | Where-Object Id -eq 1149
reg query "HKCU\Software\Microsoft\Terminal Server Client" /s

Parsing tools

EvtxECmd (Eric Zimmerman): maps for all RDP channels; filter by event ID in Timeline Explorer.
Hayabusa / Chainsaw: built-in RDP logon summaries and Sigma rules.
Registry Explorer / RegRipper (tsclient plugin): the Terminal Server Client keys.
Velociraptor: Windows.EventLogs.RDPAuth, Windows.Registry.RDP.

Investigation tips

Build a per-session table on the target: 131 (TCP) → 1149 (auth) → 4624 type 10 → 21/22 → 24/25 → 23; missing steps often tell you what failed.
Source IPs from 1149 and 21 point to the next machine to examine; on that source host, confirm with the Servers key, mstsc.exe in UserAssist and the mstsc Jump List.
Logons from 127.0.0.1 or ::1 suggest RDP tunnelled through a local port forward (for example via SSH or a reverse proxy).
The client's bitmap cache can show what the user actually saw on the remote screen.
Service accounts or newly created local accounts using RDP are a strong lead; check account creation (4720) in SAM and user accounts.

RDP connection artifacts

Tools