Skip to content

Glossary

mstsc.exe

The Remote Desktop Connection client built into Windows, which writes the RDP bitmap cache in the profile of the user who runs it.

mstsc.exe is the Remote Desktop Connection client included with Windows. It is the client that writes the persistent RDP bitmap cache, in the profile of the account that ran it, on the machine the connection starts from. This site makes no claim about other RDP clients.

Administrators run it every day, so its presence proves nothing by itself. In an investigation, its Prefetch file and jump list, together with the RDP client event log and the Terminal Server Client registry keys, place the client on the timeline and point to the targets. See RDP lateral movement: source host artifacts.