Microsoft\u2019s Remote Desktop Protocol (RDP)<\/a> has introduced a lesser-known but critical security feature colloquially referred to as \u201cincognito mode\u201d through its \/public command-line parameter.\u00a0<\/p>\n This functionality, formally called public mode, prevents the client from storing sensitive session artifacts\u2014a development with significant implications for cybersecurity, digital forensics, and enterprise IT management.<\/p>\n According to Devolutions, public mode activates when launching mstsc.exe (Microsoft Terminal Services Client) with the \/public flag, disabling key data retention mechanisms:<\/p>\n Connection Settings:<\/strong> Normally stored in the hidden %USERPROFILE%DocumentsDefault.rdp file, public mode blocks updates to this configuration repository:<\/p>\n Administrators can manually edit it via notepad \u201c~DocumentsDefault.rdp\u201d, but session-specific changes evaporate post-disconnection.<\/p>\n Credential Caching: <\/strong>The Windows Credential Manager typically stores RDP credentials under TERMSRV\/ entries. Public mode disables both retrieval and storage, forcing manual authentication each time. Forensic analysts<\/a> often query these using:<\/p>\n This command becomes obsolete in public sessions as no new credentials persist, reads the report<\/a>.<\/p>\n Persistent Bitmap Cache: <\/strong>RDP optimizes performance by caching screen fragments in %LOCALAPPDATA%MicrosoftTerminal Server ClientCache.\u00a0<\/p>\n Public mode deactivates this, though administrators can independently disable it via BitmapCachePersistEnable:i:0 in RDP files.\u00a0<\/p>\n Forensic tools<\/a> like BMC-Tools (GitHub<\/a>\/ANSSI-FR) extract bitmap artifacts from these caches, which public mode renders inert.<\/p>\n Public mode alters registry interactions critical to incident investigations:<\/p>\n MRU Server List: <\/strong>The 10 most-recently-used servers, stored in HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientDefault, cease updating. Attackers leveraging compromised systems leave no new IP\/DNS trails.<\/p>\n Username Hints:<\/strong> Registry keys like HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers<IP>UsernameHint typically reveal account names. Public mode blanks this field post-session.<\/p>\n Certificate Exceptions: <\/strong>TLS trust overrides for invalid certificates, usually recorded in CertHash values under HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers, are blocked.<\/p>\n This erases credentials, bitmap caches, and registry entries.<\/p>\n Public mode introduces usability trade-offs:<\/p>\n Cybersecurity experts recommend:<\/p>\n As RDP remains a prime target, accounting for 32% of all brute-force attacks in 2024, this feature provides critical mitigation against low-sophistication threats.<\/p>\n For IT teams, the balancing act continues: maximizing security without crippling productivity. Public mode\u2019s forensic advantages, however, make it indispensable for high-risk environments like shared kiosks or third-party vendor access points.\u00a0<\/p>\n As remote work expands, such granular controls will define the next era of endpoint security<\/a>.<\/p>\n The post Enabling Incognito Mode in RDP to Hide All the Traces<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcUbR7EO7BTt9ZgcXy8sgm4-kJkH8nprS5zDg4GrVTDkdYbmCkRt-DxsxQ7a2QXWPuMo3p_7pHm_u7vQ-wZ78ZJR49Tet25dm1Yp362BEP2guX8S3EgMuSfrsSRXV0fcadcghofmQ?key=BLhfHQhoU4HGZGuFOsO9fH1Y\")
![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcTgHgutIzLrMoTduwbEouvXtddGNa7aQqSzPmKmLwO4xZrkqc3wL2o90s1_f_7oPxweFnlITf32j3qvcY7bqPZeQe6SZsJPf34kwM2i5lXC5dS-g4syN25Hgz7oXM4XmRoJXUGKg?key=BLhfHQhoU4HGZGuFOsO9fH1Y\")
Implications and Countermeasures<\/strong><\/h2>\n
![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcO0_pDjYi18OvuNHI2sb3MPK9jtUyxLZRpljsuxaqOiuxpUSB2C8vc5je9AhA-jy21ba2j7pLrR5yVz9tsIOToVsUhA43zFErCm0cCM9Yuu8XMi0_8dhBQHe9StBTU8PEqZ8Xgrw?key=BLhfHQhoU4HGZGuFOsO9fH1Y\")
Recommendations<\/strong><\/h2>\n
\n
\n
Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup ->\u00a0Try for free<\/a><\/code><\/strong><\/strong><\/p>\n