I have somebody who showed me his RDP client history. It has a bunch of local loopback addresses with random ports. He says he never used RDP except for the one address which I blacked out which is a SQL server. I always thought RDP history shows what RDP connections the local box has accessed before.
I am guessing this isn't proper network behavior though and the random attempts with different port numbers is suspicious?
