Log inSign up
Marc-André Moreau
35.5K posts
Image
user avatar
Marc-André Moreau
@awakecoding
Remote desktop protocol expert, OSS contributor and Microsoft MVP. I love designing products with Rust, C# and PowerShell. Proud to be CTO at Devolutions. 🇨🇦
Lavaltrie, Quebec, Canada
awakecoding.com
Joined June 2010
1,940
Following
6,083
Followers
RepliesRepliesMediaMedia

New to X?

Sign up now to get your own personalized timeline!

Create account

By signing up, you agree to the Terms of Service and Privacy Policy, including Cookie Use.

Terms·Privacy·Cookies·Accessibility·Ads Info·© 2026 X Corp.
Don't miss what's happening
People on X are the first to know.
Log inSign up
  • user avatar
    Marc-André Moreau
    @awakecoding
    Sep 7, 2022
    Get-RdpLogonEvent: extract the list of recent RDP logons from the event viewer and become a magician 🧙‍♀️ that can answer impossible questions like "is it really using Kerberos (nope), or did it downgrade to NTLM (again)"? 👇 gist.github.com/awakecoding/5f…
    Image
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jun 29, 2022
    If you think OAuth is hard, wait until you see Windows authentication:
    Image
  • user avatar
    Marc-André Moreau
    @awakecoding
    May 13, 2023
    I have just updated my Wireshark guide to decrypting RDP traffic with notes on FreeRDP, IronRDP, and instructions on how to export a .pcapng file with embedded TLS session keys such that it can easily be shared with other people!
    Image
    GitHub - awakecoding/wireshark-rdp: Wireshark RDP resources
    From github.com
    57K
  • user avatar
    Marc-André Moreau
    @awakecoding
    May 17, 2024
    PSA: the list of DNS servers in Windows is not supposed to be an ordered list of DNS servers to try - if you put 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) as a "fallback" after your internal DNS server, you'll just cause random name resolution failures for internal DNS
    127K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jan 28, 2025
    My RDP IO Lab presentation on "Decrypting and Inspecting RDP traffic in Wireshark" was just *cancelled* - apparently Microsoft decided they would only do internal presentations, with no guest speakers 😠 What's the point of even trying when you get treated like this?
    This post is unavailable.
    68K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Nov 29, 2022
    Do you need to create a local user account on a Windows 11 test VM? Try using "[email protected]" with password "nope", let it fail, and then the installer will let you create a local user account 👇
    Image
    00:00
  • user avatar
    Marc-André Moreau
    @awakecoding
    Nov 24, 2022
    Do you want a *FREE* ARM server with 4 CPUs, 24GB of RAM and 200GB storage, in the cloud? 😮 It's possible using the Oracle Cloud Free Tier! Here's how 👇 cohost.org/awakecoding/po…
  • user avatar
    Marc-André Moreau
    @awakecoding
    May 3, 2021
    Replying to @aionescu
    If you click on it, Notepad gets restarted as VSCode
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jun 3, 2024
    Replying to @awakecoding
    The full OCR text with the temporarily visible password is available in the %LocalAppData%\CoreAIPlatform.00\UKP\{<UUID>}\ukg.db SQLite database, nicely gift wrapped 🎁 for infostealer malware to exfiltrate:
    Image
    85K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jun 3, 2024
    Here's Recall capturing temporarily visible passwords from Remote Desktop Manager in a test Azure VM. It's less effective that I would have thought, the search results are screenshots, and it's unclear how one can obtain the full OCR text it used for the match
    Image
    00:00
    150K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jan 21, 2022
    Achievement unlocked: #PowerShell RDP client 🚀 Yes, you read that right: launch *and control* multiple RDP connections from #PowerShell scripts! I needed a way to automate MsRdpEx (github.com/Devolutions/Ms…) for stress testing, so here it is:
    Image
    00:00
  • user avatar
    Marc-André Moreau
    @awakecoding
    Mar 24, 2025
    My Windows 11 start menu was unresponsive today, unable to find local apps. I disabled Bing search "feature" and then it started working as expected: Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" -Name "BingSearchEnabled" -Value 0
    28K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Jun 1, 2025
    🎉 It's official — I am now a Microsoft MVP in the PowerShell & Windows categories! Years of digging ⛏️ into RDP and Windows internals, and automating all the things with #PowerShell, have finally paid off 💪 I can't wait to meet everyone at the next MVP Summit! #MVPBuzz
    Image
    14K
  • user avatar
    Marc-André Moreau
    @awakecoding
    Nov 7, 2023
    TIL: Windows 11 23H2 now makes it possible to *uninstall* mstsc.exe 😱
    Image
    user avatar
    Jen Gentleman 🌺
    @JenMsft
    Nov 7, 2023
    Replying to @awakecoding @BurgerhoutJ and @smoon_lee
    Is it uninstalled? learn.microsoft.com/en-us/windows-…
    228K
Advertisement
Advertisement