How can I retrieve the Remote Desktop connection history of only the currently logged-in user during a penetration test?

You can enumerate the registry key `HKCU:\Software\Microsoft\Terminal Server Client\Servers` using a simple PowerShell loop. Each subkey represents a server, and the `UsernameHint` value stores the login username. A complete script is provided in the [article](/news/penetration-techniques-obtaining-remote-desktop-connection-history-on-windows-systems) that handles exceptions and outputs the server and user. This method requires no special privileges since it only reads the current user's hive.