> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/rdp/source-system-artifacts-quick-reference.md).

# Source System Artifacts - Quick Reference

{% tabs %}
{% tab title="Event Log" %}
**security.evtx:**

[Event ID 4648](/windows-artifacts/event-ids/security/authentication-account/4648-explicit-credentials-success.md) – Logon specifying alternate credentials 

* Current logged-on User Name
* Alternate User Name 
* Destination Host Name/IP 
* Process Name

**Microsoft-WindowsTerminalServicesRDPClient%4Operational.evtx**\
Event ID 1024 \
     \- Destination Host Name \
Event ID 1102 \
     \- Destination IP Address
{% endtab %}

{% tab title="Registry" %}

* Remote desktop destinations are tracked per-user
  * <mark style="color:yellow;">`NTUSER\Software`</mark>\ <mark style="color:yellow;">`Microsoft\Terminal Server Client\Servers`</mark>
* ShimCache – SYSTEM
  * mstsc.exe Remote Desktop Client
* BAM/DAM – SYSTEM – Last Time Executed
  * mstsc.exe Remote Desktop Client
* AmCache.hve – First Time Executed
  * mstsc.exe
* UserAssist – NTUSER.DAT
  * mstsc.exe Remote Desktop Client execution&#x20;
  * Last Time Executed&#x20;
  * Number of Times Executed
* RecentApps – NTUSER.DAT
  * mstsc.exe Remote Desktop Client execution&#x20;
  * Last Time Executed&#x20;
  * Number of Times Executed&#x20;
  * RecentItems subkey tracks connection destinations and times
    {% endtab %}

{% tab title="File System" %}

* Jumplists&#x20;
  * <mark style="color:yellow;">`C:\Users<Username>`</mark>\ <mark style="color:yellow;">`AppData\Roaming\Microsoft\Windows`</mark>\ <mark style="color:yellow;">`Recent\AutomaticDestinations\`</mark>
    * {MSTSC-APPID}- automaticDestinations-ms
      * Tracks remote desktop connection destination and times
* [Prefetch ](/windows-artifacts/program-execution/prefetch.md)– C:\Windows\Prefetch
  * mstsc.exe-{hash}.pf
* Bitmap Cache&#x20;
* <mark style="color:yellow;">`C:\USERS<USERNAME>`</mark>\ <mark style="color:yellow;">`AppData\Local\Microsoft\Terminal Server Client\Cache`</mark>
  * bcache##.bmc&#x20;
  * cache####.bin
    {% endtab %}
    {% endtabs %}