RDP-Forensic

Author(s)

• Jan Tiedemann

Tags

RDP Forensics Security EventLog RemoteDesktop Audit Compliance Monitoring Windows Investigation

Functions

Get-RDPCurrentSessions Get-RDPForensics

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

## [2.2.0] - 2026-05-27

### Added

- Added `-DomainController` parameter to query specific Domain Controller(s)
 for Kerberos (4768-4772) and NTLM (4776) pre-authentication events remotely.
- Added `-AllDomainControllers` switch to query ALL DCs in the domain for
 complete pre-authentication event coverage.
- Added automatic secure channel DC discovery via `nltest /sc_query` when
 `-IncludeCredentialValidation` is used without explicit DC parameters.
- Added WinRM (Invoke-Command) transport with automatic RPC/DCOM fallback
 for Domain Controller event queries.
- Added DC hostname in parsed event Details for traceability.
- Added DC target display in analysis header output.
- Added `Get-RDPForensics.DomainController.Tests.ps1` test file with
 comprehensive parameter, parsing, and compatibility tests.
- Added scenarios 19-21 to `Examples.ps1` for DC query workflows.

### Changed

- `-IncludeCredentialValidation` no longer requires running on a Domain
 Controller. The tool now queries DCs remotely from any Terminal Server.
- `-DomainController` and `-AllDomainControllers` implicitly enable
 `-IncludeCredentialValidation`.
- Updated `KERBEROS_NTLM_AUTHENTICATION.md` documentation to reflect
 remote DC query capability and removed DC-only constraint.
- Updated `GETTING_STARTED.md` and `QUICK_REFERENCE.md` with new
 DC query parameters and examples.