Skip to content

Add Terminal Server Client username parser - #1900

Open
wwwesh wants to merge 1 commit into
fox-it:mainfrom
wwwesh:feat/1450-terminal-server-client
Open

Add Terminal Server Client username parser#1900
wwwesh wants to merge 1 commit into
fox-it:mainfrom
wwwesh:feat/1450-terminal-server-client

Conversation

@wwwesh

@wwwesh wwwesh commented Aug 15, 2026

Copy link
Copy Markdown

Parse cached username hints stored by the Microsoft Terminal Server
Client for previously entered server names.

These registry values represent cached GUI input and do not prove that
an RDP connection or connection attempt occurred. Analysts should
corroborate the results with other artifacts, such as Windows event
logs. No assumption is made about the retention limit of the Servers
key.

Proposed Changes

  • Add a parser for
    HKCU\Software\Microsoft\Terminal Server Client\Servers.
  • Parse server names and their cached UsernameHint values.
  • Return the registry timestamp, user metadata, and registry metadata.
  • Skip server entries without a UsernameHint value.
  • Document the forensic interpretation limitations of this artifact.
  • Add tests for valid entries, missing values, and incompatible targets.

Testing

$ uv run --no-sync pytest tests/plugins/os/windows/regf/test_terminalserverclient.py -q
3 passed 

$ uv run --no-sync pytest tests/plugins/os/windows/regf -q
27 passed 
$ uv run --no-sync ruff check dissect/target/plugins/os/windows/regf/terminalserverclient.py tests/plugins/os/windows/regf/test_terminalserverclient.py
All checks passed!

$ uv run --no-sync ruff format --check dissect/target/plugins/os/windows/regf/terminalserverclient.py tests/plugins/os/windows/regf/test_terminalserverclient.py
2 files already formatted

Checklist

Closes #1450

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Registry Terminal Server Client username parser

1 participant