[EN] Your RDP Session May Leave a Visual Trail: What Is Bitmap Cache and Why Does It Matter?

Remote Desktop Protocol, commonly known as RDP, is one of the most widely used remote access methods in Windows environments. It is frequently used by system administrators, support teams, and end users to connect to servers, virtual machines, or remote workstations.

RDP is practical, fast, and built directly into Windows. However, there is a lesser-known side of this convenience: even after an RDP session ends, some visual traces of that session may remain on the client device.

One of the most important traces is known as RDP Bitmap Cache. This feature is designed to improve performance by storing small fragments of the remote screen locally on the client computer. While this helps reduce network traffic and improves the user experience, it may also create a security and privacy risk.

What Is RDP Bitmap Cache?

During an RDP session, the remote computer’s screen is continuously transmitted to the client. If every visual change were sent from scratch each time, the connection would consume more bandwidth and could become slower, especially over low-speed or unstable networks.

To optimize this process, RDP stores certain graphical elements locally on the client side. When the same visual element is needed again, the server does not have to resend it completely. Instead, the RDP client can reuse the previously cached bitmap data.

In simple terms, RDP Bitmap Cache is a local cache that stores small image fragments from what was displayed during a Remote Desktop session.

This mechanism is useful from a performance perspective. However, from a security perspective, it means that parts of what appeared on the remote screen may remain on the client device after the session has ended.

Why Can This Be a Security Risk?

RDP Bitmap Cache is not designed as a malicious feature. Its main purpose is performance optimization. However, because it stores visual fragments locally, it may expose sensitive information that appeared on the screen during a remote session.

For example, during an RDP session, the following types of information may have been visible:

• Administrative consoles
• Server names
• IP addresses
• Usernames
• File and folder names
• Application windows
• Dashboard screens
• Email content
• Log records
• Customer or corporate data
• Password vaults, ticketing systems, or management panels

These details are usually not stored as a full screenshot. Instead, they are saved as small bitmap fragments. However, with the right tools, these fragments can sometimes be extracted and reviewed, giving clues about what was visible during the session.

For this reason, RDP Bitmap Cache is considered an important artifact in digital forensics and incident response.

Where Are RDP Bitmap Cache Files Stored?

On Windows clients, RDP bitmap cache files are typically stored under the user profile in the following location:

C:\Users\<Username>\AppData\Local\Microsoft\Terminal Server Client\Cache

Using an environment variable, the path can be written as:

%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache

Inside this folder, you may see files such as:

Cache0000.bin
Cache0001.bin
Cache0002.bin
bcache24.bmc
bcache32.bmc

These files may contain cached bitmap fragments from previous RDP sessions.

Can RDP Bitmap Cache Be Extracted?

Yes. RDP Bitmap Cache files cannot be meaningfully viewed by simply opening them directly. However, there are tools that can parse these files and extract the stored bitmap fragments.

One of the well-known tools for this purpose is bmc-tools, developed by ANSSI-FR.

This tool can read RDP bitmap cache files and convert the cached fragments into image files. The extracted output may appear as many small visual pieces rather than a complete screenshot. However, in some cases, these fragments may reveal parts of application windows, text fields, system names, dashboards, or other sensitive visual information.

Example usage:

python bmc-tools.py -s "%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache" -d "C:\Temp\RDP_Cache_Output"

After running the tool, the extracted bitmap fragments are written to the destination folder. These fragments can then be reviewed during a forensic investigation or security assessment.

This type of analysis should only be performed on systems where you have proper authorization.

Why Could This Be Useful to Attackers?

If an attacker gains access to a client machine, they may not only look at active files, browser history, or saved credentials. They may also inspect forensic artifacts left behind by user activity.

RDP Bitmap Cache files may help an attacker understand what the user accessed through Remote Desktop.

For example, an attacker may try to identify:

• Which systems were accessed through RDP
• Which administrative tools were opened
• Which IP addresses or hostnames appeared on the screen
• Which applications were used
• Which folders, file paths, or dashboards were visible
• Whether sensitive systems or privileged consoles were accessed

Even if these fragments do not directly expose passwords, they may help an attacker map the environment, understand internal infrastructure, or plan further actions.

Why Is RDP Bitmap Cache Important in Digital Forensics?

From a digital forensics perspective, RDP Bitmap Cache can be a valuable artifact. It may help investigators understand user activity, remote access behavior, and possible exposure of sensitive data.

During an investigation, these files may help answer questions such as:

• Was RDP used from this client device?
• What kind of systems may have been accessed?
• Which applications or consoles may have been visible?
• Did sensitive information appear on the remote screen?
• Were RDP-related artifacts deleted or modified?

However, it is important to remember that RDP Bitmap Cache should not be treated as standalone proof. It should be analyzed together with other artifacts such as Windows Event Logs, Registry records, Prefetch files, Jump Lists, MRU entries, EDR telemetry, VPN logs, and firewall records.

How Can RDP Bitmap Cache Be Cleared?

To remove existing RDP bitmap cache files, the related cache folder can be cleaned after closing all active RDP sessions.

The cache path is:

%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache

The files inside this folder can be deleted manually.

Alternatively, PowerShell can be used:

Remove-Item "$env:LOCALAPPDATA\Microsoft\Terminal Server Client\Cache\*" -Force -ErrorAction SilentlyContinue

This command removes existing cache files from the current user profile. However, if persistent bitmap caching remains enabled, new cache files may be created again during future RDP sessions.

How Can Persistent Bitmap Caching Be Disabled?

To reduce the risk, persistent bitmap caching can be disabled on the RDP client side.

1. Disable It Through the RDP Client Interface

You can disable it from the classic Remote Desktop Connection client:

1. Run mstsc.exe.
2. Click Show Options.
3. Go to the Experience tab.
4. Uncheck Persistent bitmap caching.
5. Save the connection settings if needed.

This prevents the RDP client from storing persistent bitmap cache data for that connection.

2. Disable It in an RDP File

If you use a saved .rdp file, you can add or modify the following line:

bitmapcachepersistenable:i:0

When this value is set to 0, persistent bitmap caching is disabled for that RDP connection.

3. Disable It Through the Registry

Persistent bitmap caching can also be controlled through the user registry hive.

Registry path:

HKCU\Software\Microsoft\Terminal Server Client

Value:

BitmapCachePersistEnable = 0

PowerShell example:

New-Item -Path "HKCU:\Software\Microsoft\Terminal Server Client" -Force | Out-Null

New-ItemProperty -Path "HKCU:\Software\Microsoft\Terminal Server Client" `
  -Name "BitmapCachePersistEnable" `
  -Value 0 `
  -PropertyType DWORD `
  -Force | Out-Null

In enterprise environments, this setting can be deployed through Group Policy Preferences, Intune, endpoint management tools, or logon scripts.

Performance vs. Security

Persistent bitmap caching is not inherently bad. It exists to improve RDP performance, especially on low-bandwidth connections. In some environments, disabling it may slightly affect the user experience.

However, in security-sensitive environments, the risk of leaving visual artifacts on the client device may outweigh the performance benefit.

The decision should be based on the risk level of the environment.

For example:

• It may be acceptable for low-risk systems where performance is the main priority.
• It should be disabled on privileged administrator workstations.
• It should be disabled on shared or public devices.
• It should be disabled when accessing sensitive systems, jump servers, PAM platforms, or management consoles.
• Existing cache files should be cleaned after disabling the setting.
• During incident response, cache files should be preserved before deletion if forensic analysis is required.

Recommended Security Approach for Organizations

Organizations should treat RDP Bitmap Cache as part of their broader remote access security strategy.

Recommended actions include:

1. Identify high-risk users and systems
   Domain administrators, system administrators, database administrators, SOC analysts, and application owners should be reviewed separately because they often access sensitive systems.
2. Disable bitmap caching on privileged workstations
   Devices used for administrative access should not retain unnecessary visual artifacts.
3. Clean existing cache files
   Disabling the setting does not automatically remove older cache files. Existing files should be deleted separately.
4. Monitor RDP usage
   RDP activity should be monitored through Windows Event Logs, VPN logs, firewall logs, EDR telemetry, and SIEM correlation rules.
5. Use jump servers or bastion hosts
   Direct RDP access from personal or unmanaged devices should be avoided for critical systems.
6. Review RDP redirection settings
   Clipboard, drive, printer, smart card, and device redirection settings should also be reviewed as part of RDP hardening.
7. Include RDP artifacts in incident response procedures
   RDP Bitmap Cache, Registry entries, connection history, and related forensic artifacts should be included in investigation checklists.

RDP Bitmap Cache is a performance feature that can become a security concern if not properly understood and managed. During a Remote Desktop session, small fragments of the remote screen may be cached locally on the client device. These fragments may remain after the session ends and, in some cases, may reveal clues about what was displayed during the session.

For standard users, this may seem like a minor detail. However, for administrators, security teams, and organizations handling sensitive data, it is an important point to consider.

To reduce the risk, persistent bitmap caching should be disabled on privileged or sensitive endpoints, existing cache files should be cleaned, and RDP access should be controlled through proper security policies.

Security is not only about protecting the connection while it is active. It is also about understanding what traces remain after the connection is closed.