[DISCUSSION] Windows 10 termsrv.dll Patching

Discussion in 'Windows 10' started by Mr Jinje, Oct 2, 2014.

  1. tvcat

    tvcat MDL Novice

    Feb 23, 2011
    34
    11
    0
    Hi, I'm using Windows 10 Pro x64 with termsrv.dll 18362.267
    I had set multi session per user.
    1. User logon locally on the remote server.
    2. Client logon on the remote server and taking over the session of the locally logon user.
    3. Locally user try to logon back and got a new session.

    How do i make sure the client will always logon with a new session?
     
  2. meditation

    meditation MDL Novice

    Apr 25, 2012
    4
    3
    0

    Windows 10 Version 1903 (updated v2)

    Find:


    39 81 3C 06 00 00 0F 84 5D 61 01 00


    Replace With:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1809 (updated)

    Find:


    39 81 3C 06 00 00 0F 84 7F 2C 01 00


    Replace With:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1803

    Find:


    8B 99 3C 06 00 00 8B B9 38 06 00 00


    Replace with:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Version 1709

    Find:


    39 81 3C 06 00 00 0F 84 B1 7D 02 00


    Replace with:


    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 Threshold Wave 2 Update

    Find:

    39 81 3C 06 00 00 0F 84 3F 42 02 00


    Replace with:

    B8 00 01 00 00 89 81 38 06 00 00 90

    Windows 10 RTM 2015

    Find:

    39 81 3C 06 00 00 0F 84 73 42 02 00


    Replace with:

    B8 00 01 00 00 89 81 38 06 00 00 90

    Hope this will help you guys .

    Cheers,
     
  3. bjf2000

    bjf2000 MDL Expert

    Apr 11, 2008
    1,087
    198
    60
    The following, from up the thread, also works for the latest version of termsrv.dll (x64): 18362.657:

    39813C0600000F845D610100
    B80001000089813806000090

    58010000FF15F7
    58000000FF15F7

    047411488D1577
    04EB11488D1577
     
  4. Mach1ne

    Mach1ne MDL Novice

    Feb 27, 2020
    3
    0
    0
    Hi
    does anybody have the new termserv.dll patch for this version
    needed urgent.
    I don't use wrapper . I am after the patched version or the hex code to change the termserv.dll
     
  5. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    47,274
    94,765
    450
  6. Mach1ne

    Mach1ne MDL Novice

    Feb 27, 2020
    3
    0
    0
    hi I just tried on my ver 18363.657 dosent work any other help would be great
     
  7. Mach1ne

    Mach1ne MDL Novice

    Feb 27, 2020
    3
    0
    0
    hi
    I have ver 1909 os 18363.657
    can you help me
     
  8. flack

    flack MDL Novice

    Mar 1, 2013
    5
    0
    0
    build has nothing to do with it. this is concerning the newest termsrv version which is: 10.0.17134.1304
     
  9. bjf2000

    bjf2000 MDL Expert

    Apr 11, 2008
    1,087
    198
    60
    What specifically doesn't work? Did you double-check the patch?
     
  10. bfoos

    bfoos MDL Guide Dog

    Jun 15, 2008
    757
    701
    30
    #190 bfoos, Feb 28, 2020
    Last edited: Feb 28, 2020
    And regardless as @Enthousiast pointed out in the post directly above yours as there is an ongoing thread for discussion of termsrv.dll patching. And that's not even the newest version of the file.
     
  11. flack

    flack MDL Novice

    Mar 1, 2013
    5
    0
    0
    sure guy, what is the newest version of the file?
     
  12. flack

    flack MDL Novice

    Mar 1, 2013
    5
    0
    0
    This was an error on my part. Thankfully there's helpful traffic cops here to assist! I didn't' realize the OS build just mirrors on the termserv.dll, not sure what that is. Anyways, here is what worked for me after going to 1909 10.0.18362.657 (I was holding out for 2004) and applying KB4532693. Single session per user, the other two edits suggested allowed for multiple sessions on the same user.

    Find Hex
    39813C0600000F845D610100

    Replace with
    B80001000089813806000090
     
  13. flack

    flack MDL Novice

    Mar 1, 2013
    5
    0
    0
    I can confirm.

    Running Ver. 1909 10.0.18362.657 and after applying KB4532693. This worked for me to enable single session per user:

    Find Hex
    39813C0600000F845D610100

    Replace with
    B80001000089813806000090

    The other two edits suggested on bjf2000's post allowed for multiple sessions on the same user act.
     
  14. vanden

    vanden MDL Junior Member

    Mar 28, 2014
    76
    34
    0
    Thank you ! it works well.
     
  15. Dennisw

    Dennisw MDL Novice

    Dec 4, 2019
    8
    0
    0
    Hi there, just upgraded to 18363.693.

    C:\Windows\system32>takeown.exe /f c:\Windows\System32\termsrv.dll
    Access is denied.

    I found the termsrv.dll timestamp is today.
     
  16. bjf2000

    bjf2000 MDL Expert

    Apr 11, 2008
    1,087
    198
    60
    Some time in the last year, MS started timestamping updates in System32 according to when the update is run. It's too bad, but it was part of their efforts to reduce the amount of downloading. Bottom line: ignore dates.

    Code:
        ECHO Taking ownership of %SystemRoot%\System32\termsrv.dll
        takeown /a /f %SystemRoot%\System32\termsrv.dll
        ECHO Granting Administrators rights
        ICACLS %SystemRoot%\System32\termsrv.dll /Grant Administrators:F 
     
  17. Dennisw

    Dennisw MDL Novice

    Dec 4, 2019
    8
    0
    0
    #197 Dennisw, Mar 4, 2020
    Last edited: Mar 4, 2020
    So it is the /a does the trick to take the ownership?

    It worked, just that I had to replace the termsvc.dll in safe mode.


     
  18. Smile2020

    Smile2020 MDL Novice

    Mar 11, 2020
    9
    4
    0
    Hello dear members,

    is there a just a patch for win 10 2004, build 10.0.19041 (insider) - because the hex code from 1903 and 1909 did not work.

    thanks
     
  19. notds

    notds MDL Novice

    Mar 25, 2020
    3
    1
    0
    Same issue with 1909. What is the process for re-figuring it out? Do we need the termsrv from the 1909 windows server build?
     
  20. bjf2000

    bjf2000 MDL Expert

    Apr 11, 2008
    1,087
    198
    60
    Which issue are you referring to, the one about Insider? If so, that's not the same issue, since while Insider's DLL is in fact different (and a rapidly-moving target, so pretty impractical to do), the current patch info (see up this page) for 1903/1909 is known and valid.