Retrieve IP Address That We already RDP in our Machine

Question

Hi Everyone, I hope you all doing well. I just want to ask how can we extract IP address that we have RDP before?

For Example: User ABC try RDP to a server (10.XX.XX.XX) using his laptop - (So, where we can find history of IP Address (10.XX.XX.XX) RDP in Laptop A? )

I already try google and I found out all IP address that we have been RDP were log into this registry path location as below:

"HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"

I wonder how to extract all of the IP Address into text file or .csv

Thank You.

Answer 1

The below will export the keys created by RDP to csv

$exportfile = "C:\temp\RDPhistory.csv"
$RDPhistory = Get-childitem 'HKCU:\SOFTWARE\Microsoft\Terminal Server Client\Servers'
    $RDPhistory | Foreach-object {Get-ItemProperty $_.PsPath } | select-object PSChildName | export-csv -path $exportfile -NoTypeInformation

Answer 2

Some ideas here.
https://gallery.technet.microsoft.com/scriptcenter/site/search?query=export%20registry%20key&undefined=undefined&ac=3

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hi,

Please try below command in CMD. (run as administrator)

reg export "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Terminal Server Client\Servers" C:\exportip.txt && type C:\exportip.txt | findstr /i "key"

Thanks,
Eleven

----------

If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.

Answer 4

Thanks All,

I have found answer from @Andrew Wealleans . I hope this thread may help others also :)