The RDP Bitmap Cache: the forensic trail your remote sessions leave behind
Digital forensics · 7-min read · See exploited Windows/RDP CVEs → · updated August 2026
A post doing the rounds says “Windows secretly takes screenshots of your Remote Desktop sessions.” That’s catchy — and mostly wrong in the scary part, but right in the part that matters. There are no covert screenshots. There is a documented performance cache that quietly writes pieces of every remote screen to your local disk, where they outlive the session and the server. Here’s the accurate version, and what to do about it.
What it actually is
To keep RDP responsive, the client doesn’t re-fetch unchanged parts of the screen — it caches small 64×64-pixel bitmap tiles and reuses them. The optional persistent cache writes those tiles to disk so they survive reboots and reconnects. That’s the whole mechanism: a speed optimisation, on by default in the classic mstsc client, storing fragments of what was on screen.
%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\.Disable, clear, and harden — in order
On the machine you connect FROM, the persistent cache lives in %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\ — files named Cache####.bin (older mstsc) or bcache##.bmc (newer). It is per-user and stays there after the session ends.
The cache stores thousands of 64×64-pixel bitmap tiles of screen regions. Tools like bmc-tools (ANSSI) or BMCViewer stitch them into a collage — fragmented and out of order, but often legible enough to read an email, a document or a filename you viewed remotely.
In mstsc → Experience tab, untick "Persistent bitmap caching". To enforce it in a saved connection, set bitmapcachepersistenable:i:0 in the .rdp file. This stops new tiles being written to disk between sessions.
Close all RDP sessions, then delete the Cache####.bin / bcache##.bmc files in the Cache folder. Do this on every workstation that has connected to sensitive hosts — the data is on the client, not the server.
The cache is a data-at-rest problem; an exposed RDP service is the bigger one. Keep Windows/RDP patched, require Network Level Authentication, and never expose 3389 to the internet. Check your version against known exploited RDP CVEs.
Where it lives
| Item | Detail |
|---|---|
| Location | %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\ |
| Files | Cache####.bin (older mstsc) · bcache##.bmc (newer) |
| Tile size | 64 × 64 pixels |
| Stored on | The client (the machine initiating the connection), per user |
| Survives | Session end, reboot, and destruction of the remote host |
| Read with | bmc-tools (ANSSI) · BMCViewer |
| Turn off | mstsc → Experience → untick “Persistent bitmap caching”, or bitmapcachepersistenable:i:0 |
Two audiences, opposite goals
| You are… | Why the cache matters |
|---|---|
| A DFIR / IR investigator | After an RDP-based intrusion, the attacker’s (or jump host’s) cache can reveal what was actually viewed — consoles, files, on-screen credentials — evidence logs don’t hold. |
| A defender / privacy-conscious user | It’s sensitive data at rest on endpoints. A lost or compromised laptop can leak fragments of every admin session it ever ran. Disable persistence on devices that touch sensitive hosts. |
Turn this into action. Remote Desktop quietly caches tiles of every remote screen to your local disk — and they outlive the session. What the cache really is (no, not "secret screenshots"), what investigators can rebuild, and how to disable and clear it.
See exploited Windows/RDP CVEs — free →Frequently asked questions
Is the RDP bitmap cache spyware or "secret screenshots"?
No. It is a documented, decades-old performance feature: to avoid re-sending unchanged parts of the screen, the RDP client caches small bitmap tiles locally. It is not covert and not malware — but because it persists on disk, it becomes a forensic and data-exposure artifact.
Where is the cache stored, and on which machine?
On the CLIENT (the machine you connect from), under %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\, as Cache####.bin or bcache##.bmc files. Destroying the remote server does not remove it — the tiles are on your endpoint.
Can it be reconstructed into a clean screenshot?
Only partially. Reconstruction (e.g. with bmc-tools or BMCViewer) produces a jumbled mosaic of 64×64 tiles, not a pristine image. But it is frequently enough to recognise applications, read text and identify what a user — or an attacker — was looking at.
How do I turn it off?
Untick "Persistent bitmap caching" in mstsc → Experience, or set bitmapcachepersistenable:i:0 in your .rdp file, then delete the existing files in the Cache folder. Standardise the .rdp settings across managed devices to enforce it.
Why do forensics and IR teams care?
After an intrusion that used RDP for lateral movement, the attacker’s own client cache (or a jump host’s) can show what they actually viewed — consoles, files, credentials on screen — evidence that logs alone do not capture. It cuts both ways: defenders investigate with it, and it can leak your sensitive data if a laptop is lost or compromised.
This guide is vendor-neutral and informational, grounded in publicly-available guidance from bodies such as OWASP, NIST and CISA. IsItPatched is independent and not affiliated with them, and this is not legal or compliance advice. See our disclaimer.