How to delete RDP logs?

[BigBeast]

I need help regarding deleting RDP logs after using RDP.
How can i manually delete RDP logs from my PC & is there any way to delete them automatically?
And,for how many days a RDP can last?

 

[f4c3r100]

? Clearing RDP Connection History in Windows ?

Telegram: Contact @tutorials_zone

t.me

Read from here.

 

[Mutt]

Clearing RDP Logs (Dedicated Server Cleanup)
As we all know, when connecting to remote computers, data on ip addresses and logins are saved.
This news may not really appeal to people who monitor their anonymity on the network, therefore, I decided to post a manual for cleaning logs from rdp connections.
1. For cleaning we need the registry editor regedit.exe
2. Open it and go to the branch:

HKEY_CURRENT_USER \ Software \ Microsoft \ Terminal Server Client

Below we see two folders. The Default folder keeps a history of the last 10 RDP connections.
Servers contains a list of all servers and usernames that were previously used to log in.
3. Open the Deafult folder
There will be files named MRU from 0 to 9, in the Value column there will be a list of ip addresses.
Select all these files and delete (on the screenshot, my files have already been deleted).
4. Now go to Servers. As we can see, there is both an ip address and a username under which the login was made.
5. We need to delete all subfolders in Servers. There is also a Default.rdp file. It contains information about the last RDP connection.
6. This file is hidden, located in the Documents folder. We delete it.
7. Checking. As you can see, our logs are empty.

Delete the history of remote desktop connections (RDP)
The RDP client in Windows (command: "mstsc.exe") saves in the system its ip-address (name), as well as the name of the user under which the logon was logged, for each successful connection to a remote computer. In the future, this data is used by the RDP client, which prompts the user to select one of the connections that he has already used before, and substitutes the user's login used to log in.
This is convenient for the user, but not secure, especially when the rdp connection is initiated from a public computer.

How to delete RDP connection history on Windows:
You won't be able to clear the list of rdp connection history with the usual Windows tools; you will have to make changes to the system registry.

1. Open the registry editor (command: "regedit.exe") and go to the branch

HKEY_CURRENT_USER\Software\Microsoft\Terminal ServerClient

2. We are interested in two sections: Default (keeps a history of the last 10 rdp connections) and Servers (contains a list of all rdp servers and usernames used previously to log in).
3. Open the Default section. It contains a list of 10 terminal servers that were used most recently (MRU - Most Recently Used). The name (ip-address) of the terminal server is stored in the value of the MRU * key. To clear the history of recent rdp connections, select all keys named MRU0-MRU9, right-click and select Delete.
4. Let's go to the Servers section. It contains a list of all RDC (remote desktop client) connections that have ever been established from this computer. If you expand the branch with the name (ip-address) of any server, then in the Username \ Hint key (username hint) you can see the username under which the rdp connection was made.
5. To clear the history of all rdp connections and saved usernames, you need to clear the contents of the Servers branch.
6. In addition to the specified branches in the registry, it is necessary to delete the default rdp connection (contains information about the most recent rdp connection) stored in the Default.rdp file. The file itself is hidden and is located in the Documents directory.

This method has been tested and works on all versions of windows operating systems from 7 to 10, as well as on server systems from 2003 to 2016. If you need to completely disable the rdp history, you can restrict the system's rights to write to this registry branch (if you are not an expert, we recommend that you do not do this).

How do I clean up my logs
As mentioned above, you need to throw a script with pens for specific tasks, you can use such a batch file

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
cipher /w:C:\
del %0
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
del %0
exit

Cleans the magazine completely, after cleaning it rubs free space in 3 passes.

You can play with the log extensions that are written by third-party software .bac, .log, .tmp, etc.

for /d %%i in (C:\*) do start /b cmd /c (del "%%i\*.log")

For example, it will run hidden.

run.vbs

Set objShell = WScript.CreateObject("WScript.Shell")
objShell.Run("run.cmd"), 0, True

run.bat

PING -n 30 -w 10 127.0.0.1 > nul
del hide.vbs
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
cipher /w:C:\
del %0
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
del %0
exit

Counts 30 seconds and runs for 30 seconds enough to disconnect from the RDP mode is necessary so that when the logs are overwritten, the cmd window does not wash because overwriting free space is not a fast procedure.

And, here's another version of a batch file for cleaning logs on Windows Dedicated computers.
I use it.

@echo off
timeout /T 60
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared!
goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1

goto :eof
:noAdmin
echo You must run this script as an Administrator!
echo.
:theEnd
rd /s /q %systemdrive%\$RECYCLE.BIN
del %0

There is also such a program for cleaning logs on Windows RDP computers.
True, not everyone will like it - no open source code.

Download:
xDedicLogCleaner.rar

In the furnace code:

forfiles.exe /p C:\ /s /m *.* /D 15.07.2021 /c "cmd /c del /q /f @file"

Use only gently.

/ D 15/07/2021 (will delete all files that were created today)

Output update today could conveniently see where files inherit
[CODE]forfiles.exe /p C:\ /s /m *.* /D 15.07.2021 /c "cmd /c echo @path @fdate >> "C:\Result.txt"
notepad "C:\Result.txt"
exit

You can change attributes, delete, change the creation date, overwrite, etc.

 

[Madmanlucifer]

Use this