What is the “RDP Client” Windows forensic artifact?

When a user initiates an outbound Remote Desktop connection, Windows quietly records the client-side details inside that user’s registry hive (NTUSER.DAT). This artifact captures the servers and hosts the user connected to, the usernames they authenticated with, and the configuration of each session — display settings, resource redirection, and connection preferences. Unlike server-side logs, which record who knocked on a machine’s door, the RDP Client artifact is the diary of where a specific user went, written on the device they actually sat at.

For a DFIR investigator, this distinction is decisive. Server-side event logs are scattered across every host a subject touched — but the client-side history lives in one place and persists even when the destination machines are unavailable, wiped, or outside the organization’s control. Correlating RDP Client entries with logon events, process execution, and file activity allows analysts to reconstruct remote access behavior with precision: which internal systems a user pivoted to, when, and with what credentials.

Enterprise Forensic Applications

RDP Client analysis is central to reconstructing lateral movement and unauthorized remote access. During Proactive Compromise Assessments, TensorGuard parses client-side RDP history across the fleet to surface workstations that initiated connections to sensitive or unmanaged systems — a hallmark of an intruder moving between machines with stolen credentials, or of an employee reaching systems outside their role. In insider investigations, these records quietly answer the question every other tool struggles with: not just what happened on this device, but where else its user has been.

Collecting, Decoding, and Viewing “RDP Client” with TensorGuard

1. Create a TensorGuard account and sign in to the TensorGuard console at https://app.tensorguard.com.
2. Select “Case Manager”, then the plus button to create a case. This will contain your enrolled devices, their reports, and any manually submitted collections.
3. Linked inside the case menu, download the TensorGuard Forensic Collector and run it on your target system.
4. In the console, click the plus button for “New Enrollment”, copy the enrollment key, and paste it into the TensorGuard Forensic Collector on your target device.
5. Now that you have a device enrolled, select the device(s), and click “Send Signal”. Answer the questions regarding what you want to look for in the analysis, any alerting on positive findings, and if the collection and analysis should be recurring.
6. Once the report is generated, you’ll have RDP Client delivered in the browser, alongside an executive summary and timeline of findings.