Skip to content
RDPCacheparser

Glossary

Terminal Server Client registry keys

Per-user registry keys of the Remote Desktop client: Servers\<host> with UsernameHint, and Default with the MRU0 to MRU9 list of recent targets.

In each user's NTUSER.DAT, the Remote Desktop client keeps two keys of interest under HKCU\Software\Microsoft\Terminal Server Client:

  • Servers\<host>: one subkey per target, with UsernameHint, the user name used for it;
  • Default: values MRU0 to MRU9, the recent targets offered by the client.

Together they show which targets an account connected to and with which user name, which helps tie the account's RDP bitmap cache to specific hosts. See RDP lateral movement: source host artifacts.