I&#39;m wondering if there is a plugin/command to extract commands that have been run in the past via RDP/telnet etc...I have taken a look at few things, but usually I would look in the csrss.exe process dump.  However, we went to an overall memory dump recently and it makes it a little more difficult to parse through.  <br>
<br>Thanks for any input <br>Jesse<br>