Wednesday, March 19, 2014

EnCase EnScript to parse & display recent RDP sessions from user's NTUSER.DAT

This EnScript was designed as a "quick hit" to parse and show the MRU values for the Terminal server client for each user.

The EnScript checks the Software\Microsoft\Terminal Server Client\Default for each NTUSER.DAT and displays/bookmarks any values.



*The link below has been updated to an EnScript that can be run in either v6 & v7.

Download EnCase v6 & v7 here
at

3 comments:

  1. jason pickensWednesday, 19 March, 2014

    is the enscript compatible with v7?

    ReplyDelete
  2. Lance MuellerWednesday, 19 March, 2014

    This comment has been removed by the author.

    ReplyDelete
  3. Lance MuellerWednesday, 19 March, 2014

    I have updated the EnScript and it can now be run in either v6 or v7. The link above is now pointing to the new version.

    ReplyDelete