I'm wondering if there is a plugin/command to extract commands that have been run in the past via RDP/telnet etc...I have taken a look at few things, but usually I would look in the csrss.exe process dump. However, we went to an overall memory dump recently and it makes it a little more difficult to parse through. Thanks for any input Jesse