Enabling Incognito Mode in RDP to Hide All the Traces

Microsoft’s Remote Desktop Protocol (RDP) has introduced a lesser-known but critical security feature colloquially referred to as “incognito mode” through its /public command-line parameter. This functionality, formally called public mode, prevents the client from storing sensitive session artifacts—a development with significant implications for cybersecurity, digital forensics, and enterprise IT management. According to Devolutions, public mode […] The post Enabling Incognito Mode in RDP to Hide All the Traces appeared first on Cyber Security News.

Mar 7, 2025 - 11:14

Enabling Incognito Mode in RDP to Hide All the Traces

Microsoft’s Remote Desktop Protocol (RDP) has introduced a lesser-known but critical security feature colloquially referred to as “incognito mode” through its /public command-line parameter.

This functionality, formally called public mode, prevents the client from storing sensitive session artifacts—a development with significant implications for cybersecurity, digital forensics, and enterprise IT management.

According to Devolutions, public mode activates when launching mstsc.exe (Microsoft Terminal Services Client) with the /public flag, disabling key data retention mechanisms:

Connection Settings: Normally stored in the hidden %USERPROFILE%\Documents\Default.rdp file, public mode blocks updates to this configuration repository:

Administrators can manually edit it via notepad “~\Documents\Default.rdp”, but session-specific changes evaporate post-disconnection.

Credential Caching: The Windows Credential Manager typically stores RDP credentials under TERMSRV/ entries. Public mode disables both retrieval and storage, forcing manual authentication each time. Forensic analysts often query these using:

This command becomes obsolete in public sessions as no new credentials persist, reads the report.

Persistent Bitmap Cache: RDP optimizes performance by caching screen fragments in %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache.

Public mode deactivates this, though administrators can independently disable it via BitmapCachePersistEnable:i:0 in RDP files.

Forensic tools like BMC-Tools (GitHub/ANSSI-FR) extract bitmap artifacts from these caches, which public mode renders inert.

Implications and Countermeasures

Public mode alters registry interactions critical to incident investigations:

MRU Server List: The 10 most-recently-used servers, stored in HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default, cease updating. Attackers leveraging compromised systems leave no new IP/DNS trails.

Username Hints: Registry keys like HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\UsernameHint typically reveal account names. Public mode blanks this field post-session.

Certificate Exceptions: TLS trust overrides for invalid certificates, usually recorded in CertHash values under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers, are blocked.

This erases credentials, bitmap caches, and registry entries.

Recommendations

Public mode introduces usability trade-offs:

Repeated credential entry slows workflows
Loss of MRU server lists hampers quick reconnections
Bitmap cache disabling may reduce performance on high-latency networks

Cybersecurity experts recommend:

Combining /public with Network Level Authentication (NLA) for layered security.
Deploying enterprise-grade privileged access management (PAM) solutions for Just-In-Time access controls.
Regular audits of Default.rdp and Terminal Server Client registry keys

As RDP remains a prime target, accounting for 32% of all brute-force attacks in 2024, this feature provides critical mitigation against low-sophistication threats.

For IT teams, the balancing act continues: maximizing security without crippling productivity. Public mode’s forensic advantages, however, make it indispensable for high-risk environments like shared kiosks or third-party vendor access points.

As remote work expands, such granular controls will define the next era of endpoint security.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free

The post Enabling Incognito Mode in RDP to Hide All the Traces appeared first on Cyber Security News.