[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. tvcat

    tvcat MDL Novice

    Joined:
    Feb 23, 2011
    Messages:
    32
    Likes Received:
    10
    Trophy Points:
    0
    Hi, I'm using Windows 10 Pro x64 with termsrv.dll 18362.267
    I had set multi session per user.
    1. User logon locally on the remote server.
    2. Client logon on the remote server and taking over the session of the locally logon user.
    3. Locally user try to logon back and got a new session.

    How do i make sure the client will always logon with a new session?
     
  2. meditation

    meditation MDL Novice

    Joined:
    Apr 25, 2012
    Messages:
    4
    Likes Received:
    3
    Trophy Points:
    0

    Windows 10 Version 1903 (updated v2)

    Find:


    39 81 3C 06 00 00 0F 84 5D 61 01 00


    Replace With:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1809 (updated)

    Find:


    39 81 3C 06 00 00 0F 84 7F 2C 01 00


    Replace With:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1803

    Find:


    8B 99 3C 06 00 00 8B B9 38 06 00 00


    Replace with:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1709

    Find:


    39 81 3C 06 00 00 0F 84 B1 7D 02 00


    Replace with:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Threshold Wave 2 Update

    Find:

    39 81 3C 06 00 00 0F 84 3F 42 02 00


    Replace with:

    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 RTM 2015

    Find:

    39 81 3C 06 00 00 0F 84 73 42 02 00


    Replace with:

    B8 00 01 00 00 89 81 38 06 00 00 90

    Hope this will help you guys .

    Cheers,
     
  3. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    The following, from up the thread, also works for the latest version of termsrv.dll (x64): 18362.657:

    39813C0600000F845D610100
    B80001000089813806000090

    58010000FF15F7
    58000000FF15F7

    047411488D1577
    04EB11488D1577
     
  4. Mach1ne

    Mach1ne MDL Novice

    Joined:
    Feb 27, 2020
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    0
    Hi
    does anybody have the new termserv.dll patch for this version
    needed urgent.
    I don't use wrapper . I am after the patched version or the hex code to change the termserv.dll
     
  5. Enthousiast

    Enthousiast MDL Tester

    Joined:
    Oct 30, 2009
    Messages:
    35,561
    Likes Received:
    59,622
    Trophy Points:
    450
  6. Mach1ne

    Mach1ne MDL Novice

    Joined:
    Feb 27, 2020
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    0
    hi I just tried on my ver 18363.657 dosent work any other help would be great
     
  7. Mach1ne

    Mach1ne MDL Novice

    Joined:
    Feb 27, 2020
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    0
    hi
    I have ver 1909 os 18363.657
    can you help me
     
  8. flack

    flack MDL Novice

    Joined:
    Mar 1, 2013
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    0
    build has nothing to do with it. this is concerning the newest termsrv version which is: 10.0.17134.1304
     
  9. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    What specifically doesn't work? Did you double-check the patch?
     
  10. bfoos

    bfoos MDL Guide Dog

    Joined:
    Jun 15, 2008
    Messages:
    757
    Likes Received:
    696
    Trophy Points:
    30
    #190 bfoos, Feb 28, 2020
    Last edited: Feb 28, 2020
    And regardless as @Enthousiast pointed out in the post directly above yours as there is an ongoing thread for discussion of termsrv.dll patching. And that's not even the newest version of the file.
     
  11. flack

    flack MDL Novice

    Joined:
    Mar 1, 2013
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    0
    sure guy, what is the newest version of the file?
     
  12. flack

    flack MDL Novice

    Joined:
    Mar 1, 2013
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    0
    This was an error on my part. Thankfully there's helpful traffic cops here to assist! I didn't' realize the OS build just mirrors on the termserv.dll, not sure what that is. Anyways, here is what worked for me after going to 1909 10.0.18362.657 (I was holding out for 2004) and applying KB4532693. Single session per user, the other two edits suggested allowed for multiple sessions on the same user.

    Find Hex
    39813C0600000F845D610100

    Replace with
    B80001000089813806000090
     
  13. flack

    flack MDL Novice

    Joined:
    Mar 1, 2013
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    0
    I can confirm.

    Running Ver. 1909 10.0.18362.657 and after applying KB4532693. This worked for me to enable single session per user:

    Find Hex
    39813C0600000F845D610100

    Replace with
    B80001000089813806000090

    The other two edits suggested on bjf2000's post allowed for multiple sessions on the same user act.
     
  14. vanden

    vanden MDL Junior Member

    Joined:
    Mar 28, 2014
    Messages:
    72
    Likes Received:
    33
    Trophy Points:
    0
    Thank you ! it works well.
     
  15. Dennisw

    Dennisw MDL Novice

    Joined:
    Dec 4, 2019
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    0
    Hi there, just upgraded to 18363.693.

    C:\Windows\system32>takeown.exe /f c:\Windows\System32\termsrv.dll
    Access is denied.

    I found the termsrv.dll timestamp is today.
     
  16. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    Some time in the last year, MS started timestamping updates in System32 according to when the update is run. It's too bad, but it was part of their efforts to reduce the amount of downloading. Bottom line: ignore dates.

    Code:
        ECHO Taking ownership of %SystemRoot%\System32\termsrv.dll
        takeown /a /f %SystemRoot%\System32\termsrv.dll
        ECHO Granting Administrators rights
        ICACLS %SystemRoot%\System32\termsrv.dll /Grant Administrators:F 
     
  17. Dennisw

    Dennisw MDL Novice

    Joined:
    Dec 4, 2019
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    0
    #197 Dennisw, Mar 4, 2020
    Last edited: Mar 4, 2020
    So it is the /a does the trick to take the ownership?

    It worked, just that I had to replace the termsvc.dll in safe mode.


     
  18. Smile2020

    Smile2020 MDL Novice

    Joined:
    Mar 11, 2020
    Messages:
    7
    Likes Received:
    3
    Trophy Points:
    0
    Hello dear members,

    is there a just a patch for win 10 2004, build 10.0.19041 (insider) - because the hex code from 1903 and 1909 did not work.

    thanks
     
  19. notds

    notds MDL Novice

    Joined:
    Mar 25, 2020
    Messages:
    3
    Likes Received:
    1
    Trophy Points:
    0
    Same issue with 1909. What is the process for re-figuring it out? Do we need the termsrv from the 1909 windows server build?
     
  20. bjf2000

    bjf2000 MDL Expert

    Joined:
    Apr 11, 2008
    Messages:
    1,015
    Likes Received:
    156
    Trophy Points:
    60
    Which issue are you referring to, the one about Insider? If so, that's not the same issue, since while Insider's DLL is in fact different (and a rapidly-moving target, so pretty impractical to do), the current patch info (see up this page) for 1903/1909 is known and valid.