What is the RDP Bitmap Cache?
A plain-English definition · all security terms → · updated August 2026
The RDP Bitmap Cache is a performance feature of the Windows Remote Desktop client that saves small 64×64-pixel tiles of the remote screen to your local disk. Its persistent form keeps those tiles after the session ends — so pieces of what you viewed remotely outlive the connection, the reboot, and even the remote server itself. It is not "secret screenshots"; it is documented behaviour. But it is a real digital-forensics artifact and a data-exposure risk.
Where it is stored
On the client you connect from, per user, in %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\ — as Cache####.bin (older mstsc) or bcache##.bmc (newer) files. Destroying the remote host does not remove it; the tiles are on your endpoint.
What can be recovered
Forensics tools such as bmc-tools (ANSSI) and BMCViewer stitch the cached tiles into a collage. The result is fragmented and out of order — not a pristine screenshot — but frequently legible enough to read an email, a document, a filename or a console that was on screen during the session.
Why it matters — two sides
- Digital forensics / IR: after an RDP-based intrusion, the cache can show what an attacker actually viewed during lateral movement — evidence logs don't hold.
- Privacy / defence: it's sensitive data at rest. A lost or compromised laptop can leak fragments of every admin session it ever ran.
How to disable and clear it
- In
mstsc→ Experience, untick "Persistent bitmap caching"; or setbitmapcachepersistenable:i:0in your.rdpfile. - Delete the existing
Cache####.bin/bcache##.bmcfiles in the Cache folder. - The bigger lesson: keep RDP patched and off the public internet — it has a long history of wormable, actively-exploited bugs.
For the full walkthrough — finding it, reconstructing it, disabling it and reducing your RDP attack surface — read the RDP Bitmap Cache guide.
Check your own software
- Check a version — paste a product + version (e.g. Windows Server) for an instant verdict.
- Actively exploited CVEs — the 431 KEV flaws affecting tracked software, including RDP/Windows.
Frequently asked questions
What is the RDP Bitmap Cache?
The RDP Bitmap Cache is a performance feature of the Windows Remote Desktop client (mstsc). To avoid re-sending unchanged parts of the screen, the client saves small 64×64-pixel bitmap tiles of the remote display. The persistent cache writes those tiles to disk, where they survive the session, a reboot, and even the destruction of the remote server.
Is it spyware or secret screenshots?
No. It is documented, decades-old behaviour built into the RDP client for speed — not covert and not malware. But because the tiles persist on disk, the cache becomes both a digital-forensics artifact and a data-exposure risk.
Where is the RDP Bitmap Cache stored?
On the client you connect FROM, per user, in %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\ — as Cache####.bin (older mstsc) or bcache##.bmc (newer) files. It is not on the remote server.
Can the cache be turned into screenshots?
Only partially. Tools such as bmc-tools (ANSSI) and BMCViewer stitch the tiles into a mosaic — fragmented and out of order, not a clean image — but often legible enough to read an email, document or console that was on screen.
How do I disable and clear it?
Untick "Persistent bitmap caching" in mstsc → Experience, or set bitmapcachepersistenable:i:0 in your .rdp file, then delete the existing files in the Cache folder. Do this on any device that connects to sensitive hosts.
Why do forensics teams care about it?
After an RDP-based intrusion, the cache can reveal what an attacker actually viewed during lateral movement — evidence that logs alone do not capture. The same property means a lost or compromised laptop can leak fragments of every session it ran.
IsItPatched is an independent service. The RDP Bitmap Cache is a feature of Microsoft Windows; tool names (bmc-tools, BMCViewer) belong to their respective authors. Always verify configuration steps against Microsoft's official documentation — see our disclaimer. 638 products tracked.