Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows 10 / How to View and Clear RDP Connections History in Windows

March 11, 2024

How to View and Clear RDP Connections History in Windows

The built-in Windows Remote Desktop Connection client (mstsc.exe) saves the remote computer name (or IP address) and the username that is used to log in after each successful connection to the remote RDP host. The next time the RDP client starts, the user can select one of the saved connections, and the previous username is automatically inserted. If you are using a public computer or a computer you don’t trust, you may want to clear your RDP connection history for security reasons.

Contents:
  • Delete the History of Remote Desktop Connections on Windows
  • Script to Clear RDP Connection History
  • How to Clear Remote Desktop Bitmap Cache?
  • How to Prevent Windows from Saving RDP Connection History
  • Remove Saved RDP Credentials on Windows

history of rdp connections in windows

This article describes where Windows stores Remote Desktop connection history and credentials, and how to clear RDP history and logs.

Delete the History of Remote Desktop Connections on Windows

Windows stores the history of Remote Desktop client connections in several different places, and to completely clear the RDP history you will need to delete the data from all of these places.

How to Delete RDP Connection History from Registry

  1. Open the Registry Editor (regedit.exe) and go to the reg key HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client;
  2. The Default subkey contains history entries for the last 10 RDP connections. The names of the parameters are MRU0-MRU9 (MRU – Most Recently Used). Their values contain IP addresses/RDP host names. Select all the registry parameters in the key and delete them;remove recent rdp entires from registry
  3. Then expand the Servers subkey. A list of all previously used RDP hosts and user accounts is stored here. The username is contained in the UsernameHint parameter. This username is automatically inserted into the mstsc.exe client window when you connect to this RDP host. The CertHash parameter contains the thumbprint of the server’s RDP certificate (see: “Configuring trusted TLS/SSL certificates for RDP“); rdp history in registry: saved host and username
  4. Clear all entries in the Servers registry key. The easiest way to do this is to simply delete the entire Servers reg key, and then re-create it manually.delete recent rdp servers in registry

Delete the Default.RDP File

Then delete the hidden Default.rdp file from the %userprofile%\Documents folder in the user profile. This file stores information about the last RDP connection.

How to View and Clear RDP Event Viewer Logs in Windows

The RDP client also logs each outbound connection to the Event Viewer log (Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-ClientActiveXCore -> Microsoft-Windows-TerminalServices-RDPClient/Operational).

View RDP client logs in Event Viewer

To list the log for outbound RDP client connections, use the Get-WinEvent cmdlet to select and filter the events in the Event Viewer:

$properties = @(
@{n='TimeStamp';e={$_.TimeCreated}}
@{n='LocalUser';e={$_.UserID}}
@{n='Target RDP host';e={$_.Properties[1].Value}}
)
Get-WinEvent -FilterHashTable @{LogName='Microsoft-Windows-TerminalServices-RDPClient/Operational';ID='1102'} | Select-Object $properties

PowerShell: view RDP client connection logs

Learn more about how to view and analyze RDP connection logs.

You can clear this event log from the Event Viewer console or by using the command:

WevtUtil cl Microsoft-Windows-TerminalServices-RDPClient/Operational

Delete Recent RDP History Entries from the Start Menu and Taskbar

Windows also stores recent remote desktop connections in Jump Lists. If you type mstsc in the Windows search box or right-click on the client in the taskbar, you will see the history of previous RDP connections in the Recent list.

To clear the RDP history in the Start Menu and Jump Lists, clear the Recent Items list by deleting the files in the %AppData%\Microsoft\Windows\Recent\AutomaticDestinationsdirectory.rdp: recent items jump lists on windows 10

Script to Clear RDP Connection History

To quickly clear the history of RDP connections in Windows, you can use a batch script. This script will automatically perform the manual actions described above to clear the connection history and the RDP logs.

@echo off
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
attrib -s -h %userprofile%\documents\Default.rdp
del %userprofile%\documents\Default.rdp
del /f /s /q /a %AppData%\Microsoft\Windows\Recent\AutomaticDestinations

A similar PowerShell script to clear all entries in the RDP connection history:

Get-ChildItem "HKCU:\Software\Microsoft\Terminal Server Client" -Recurse | Remove-ItemProperty -Name UsernameHint -Ea 0
Remove-Item -Path 'HKCU:\Software\Microsoft\Terminal Server Client\servers' -Recurse  2>&1 | Out-Null
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Terminal Server Client\Default' 'MR*'  2>&1 | Out-Null
$docs = [environment]::getfolderpath("mydocuments") + '\Default.rdp'
remove-item  $docs  -Force  2>&1 | Out-Null

If you want to automatically clear the RDP history when the user logs off, you can run this code as a logoff GPO script.

How to Clear Remote Desktop Bitmap Cache?

By default, the mstsc.exe client caches rarely modified areas of the remote desktop as bitmaps (persistent bitmap caching). The RDP client cache can significantly reduce network traffic.

The RDP client cache is stored in *.bmc and *.bin files in the %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cachefolder.

rdp bitmap cache files: bmc and bin

The RDP cache contains raw bitmaps of the RDP screen in the form of 64×64 pixel tiles. Attackers can use simple PowerShell or Python scripts (easily searched using the RDP Cached Bitmap Extractor query) to capture large areas of the remote desktop from cached PNGs.

extract png image from rdp cache files RDP Cached Bitmap Extractor

For security reasons, it is recommended that you clear the RDP cache folder and prevent the RDP client from saving the screen image to the cache. Disable the Persistent bitmap caching option on the Advanced tab of the Remote Desktop Connection client.

rdc (mstsc) client: disable bitmap caching

How to Prevent Windows from Saving RDP Connection History

If you do not want Windows to store the history of RDP connections, you must deny writing to the HKCU\Software\Microsoft\Terminal Server Client registry key. The first step is to disable the inheritance of permissions on the specified reg key (Permissions -> Advanced -> Disable inheritance). Then change the ACL of the registry key by selecting the Deny for users (but you should be aware that this is an unsupported configuration).

prevent windows from saving rdp history in registry

As a result, mstsc.exe is simply not able to write any RDP connection information to the registry.

Remove Saved RDP Credentials on Windows

The RDP client allows you to store the user’s password in the built-in Windows Credential Manager and automatically connect to a remote host without entering a password.

mstsc can save rdp credentials

Learn more about using saved RDP passwords in Windows.

You can delete saved RDP passwords from the Credential Manager window (run the command rundll32.exe keymgr.dll,KRShowKeyMgr ).  Remove all entries prefixed TERMSRV\.

Delete saved RDP (termsrv) credentials

Or you can clear the stored credentials for RDP with the command:

For /F "tokens=1,2 delims= " %G in ('cmdkey /list ^| findstr "target=TERMSRV"') do cmdkey /delete %H

You can prevent users from saving RDP passwords by enabling the Group Policy option Network access: Do not allow storage of passwords and credentials for network authentication (under Computer Configuration -> Administrative Templates -> Windows Components -> Desktop Services -> Remote Desktop Connection Client).
10 comments
7
Facebook Twitter Google + Pinterest
Windows 10Windows 11Windows Server 2019
previous post
MBR2GPT: Converting MBR to GPT Disk in Windows 10
next post
Keepalived: Configuring High Availability with IP Failover on CentOS/RHEL

Related Reading

Fixing “Winload.efi is Missing or Contains Errors” in...

March 16, 2024

How to Clean Up System Volume Information Folder...

March 17, 2024

How to Disable UAC Prompt for Specific Applications...

March 11, 2024

Protecting Remote Desktop (RDP) Host from Brute Force...

February 5, 2024

Fix: Photos App in Windows 10 Opens Extremely...

April 19, 2023

How to Refresh (Update) Group Policy Settings on...

August 13, 2024

Software RAID1 (Mirror) for Boot Drive on Windows

February 24, 2025

Managing Administrative Shares (Admin$, IPC$, C$) on Windows

March 15, 2024

10 comments

Gray Fox March 17, 2017 - 2:13 pm

Thanks for your post. I was looking to clear the last connection, and deleting the default.rdp file helped in that regard. Thanks again!

Reply
robertson thomas October 18, 2018 - 12:04 pm

I am still getting the username once I login to the RDP

Reply
Vahid March 27, 2019 - 2:53 pm

go to “Documents” folder and delete “Default.rdp”

Reply
Telbus April 24, 2019 - 7:06 am

In windows 10 there is still a recent connection list when you search RDP in bottom search bar and it brings the RDP client app in the result. How to clear that too?

Reply
Pirulo November 1, 2019 - 1:44 pm

Thanks, it worked.

Reply
adm January 1, 2020 - 9:54 pm

still leaves sum info on the resents on windows 10

Reply
Mahair June 3, 2020 - 1:18 pm

Is there a way to prevent RDP from caching remote computer name
I do not want RDP to cache remote computer name at all

Reply
DNT February 23, 2021 - 3:50 am

Thanks for publishing this forum. It was very helpful to me.

Reply
venkatarangaN July 13, 2021 - 9:54 am

Thanks, the script worked and saved a lot of time

Reply
Piyush September 5, 2022 - 8:36 am

Hello,

This batch file does not work on Windows 11. Is there a way to make it work on Windows 11? Please help me out. Please

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • How to Download Offline Installer (APPX/MSIX) for Microsoft Store App
  • Fix: Windows Cannot Connect to a Shared Printer
  • How to Disable UAC Prompt for Specific Applications in Windows
  • Fix: The Computer Restarted Unexpectedly or Encountered an Unexpected Error on Windows
  • How to Clean Up System Volume Information Folder on Windows
  • Fixing “Winload.efi is Missing or Contains Errors” in Windows 10
  • How to Enable Windows Auto Login without a Password
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top