One Day Sec

How can I retrieve the Remote Desktop connection history of only the currently logged-in user during a penetration test?

You can enumerate the registry key `HKCU:\Software\Microsoft\Terminal Server Client\Servers` using a simple PowerShell loop. Each subkey represents a server, and the `UsernameHint` value stores the login username. A complete script is provided in the article that handles exceptions and outputs the server and user. This method requires no special privileges since it only reads the current user's hive.
RDP historycurrent userregistry enumerationPowerShellpenetration testing

Browse all Q&A →