Terminal Server on Remko's Blog

RD Gateway connection fails on Windows 7

Thu, 15 Aug 2013 11:27:15 +0000

I needed to connect remotely via Remote Desktop to a Windows Server 2012 machine.

I received an rdp file that was configured to use an RD Gateway server:

However when trying to connect from my Windows 7 laptop (x64) machine, I got the following error message:

Return username instead of computername in a ThinApp

Tue, 15 Jan 2013 11:50:07 +0000

One of the lesser known features of VMware ThinApp is that you can supply a Virtual Computer name.

This is documented as follows in the package.ini reference guide:

VirtualComputerName Parameter
The VirtualComputerName parameter determines whether to rename the computer name, to avoid naming conflicts between the capture process and the deployment process.

Return username instead of computername to Applications

Thu, 06 Dec 2012 10:45:40 +0000

Some applications use the computer's name as a unique identifier, rather than using the user name. In a single-user-per-computer environment, this strategy works well.

However, in a Multi User environment such as Citrix XenApp or Microsoft's Remote Desktop Services (Terminal Server), all connected users report the same computername.

If the application relies on unique computernames to handle tasks such as file and record locking, then the application will fail.

We can however set an Application Compatibility Flag in the registry to return the username instead of the computername.

To demonstrate this behaviour I wrote a small Test Application called TestAppCompatFlags.exe.

File not found error when scanning using Twain Redirection in Citrix XenApp

Tue, 04 Dec 2012 15:07:10 +0000

Scanners attached to client machines can be used from within a Citrix XenApp session via a mechanism called Twain Redirection.

For this mechanism to work correctly the file twain_32.dll must be present in the Windows directory.

On Windows 2008 this dll should be copied from winsxs (side by side) to the windows directory as described in CTX123981.

On Windows 2003 the dll is already in the correct directory, however applications that are not Terminal Server Aware cannot find this dll because the Windows directory is redirected to the user profile. Citrix recommends copying twain_32.dll to each user’s profile directory but this will take up unnecessary space.

So what alternatives do we have?

NTVDM encountered a hard error

Wed, 14 Dec 2011 21:41:22 +0000

Today I troubleshooted an old DOS application that needed to run on a 32 bit Citrix XenApp Server. The last time I saw an actual DOS application in a production environment must be years ago.

When starting the application, the WOW subsystem (NTVDM) crashed with the message: "NTVM encountered a hard error.":

After spending some time troubleshooting I remembered a similar issue from a few years ago where a DOS application worked fine from the Console but refused to work from an RDP or ICA session.

SSL Certificates in termsrv.dll

Mon, 02 May 2011 14:54:39 +0000

I was digging around in termsrv.dll yesterday when I noticed that there are some (well 372 to be exact) SSL certificates inside the Terminal Server binary (termsrv.dll):

Two of them seem to actually contain the private keys as well, but I am not 100% sure it may be just a certificate in another format.

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 3 (implementation details)

Thu, 03 Mar 2011 13:00:46 +0000

In the previous parts (part 1 part 2) i’ve described the theoretical part and implementation problems. So, now we can write the code:

In case we login the user, we just call LsaLogonUser to get the token:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 2 (problems and workarounds)

Wed, 02 Mar 2011 00:10:02 +0000

In part 1 I’ve described the theoretical parts needed for a custom autologon application implementation.

But there are some practical problems which I will describe here.

I use the LsaLogonUser function to log in the user. However, if I do not pass not null for the LocalGroups parameter, msgina.dll fails to process the logon.

Why? Because it looks for the SE_GROUP_LOGON_ID SID and treat it as logon SID. So we have to add the logon SID manually:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 1 (theory)

Mon, 28 Feb 2011 10:46:29 +0000

Windows XP introduced the ability to use Fast User Switching (FUS from here on), which is implemented using Terminal Services.

But in some cases (i.e. when FUS is not enabled, or when you connect to the console in Windows 2003 server), the Winlogon process in an RDP session needs to transfer credentials to Session 0.

Although not documented in MSDN, the process of transferring credentials is described by Keith Brown in the June 2005 issue of MSDN magazine: Customizing GINA, Part 2.

WlxQueryConsoleSwitchCredentials and WlxGetConsoleSwitchCredentials are used in the transfer with the semi-documented WLX_SAS_TYPE_AUTHENTICATED SAS code constant.

Internally, winlogon.exe uses a Named Pipe, \.\Pipe\TerminalServer\AutoReconnect, to implement both of these functions.

The pipe format is described in this structure:

The Case of the Citrix Ready Printer Driver

Tue, 08 Feb 2011 21:47:44 +0000

I had a very interesting issue today on a new Citrix XenApp 5 farm. We went into production yesterday and we noticed a number of issues:

Printing in general was slow, especially when a user connects to a printer for the first time.
User Profiles were rapidly growing in size (from the expected 1-2 MB to over 40 MB).
Logons took much longer then in the testing period (and since we use a Full Screen Desktop the user doesn't see any progress).
Performance monitoring showed CPU spikes in Word, Excel and IE processes.

I took a look at the profiles first and noticed that the size growth was due to a Xerox subfolder in %APPDATA%:

Using Fast User Switching on domain XP computers

Sun, 30 Jan 2011 20:42:20 +0000

As you may know, Fast User Switching (FUS) is not available (disabled) on Windows XP computers joined to a domain, Microsoft confirms this in kb280758.

However, Microsoft doesn’t tell us there’s an undocumented registry value that allows us to have FUS when joined to a domain!

To enable FUS you need to set the DWORD registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceFriendlyUI.

It can also be set by Group Policy at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

When the value is set to 1, and LogonType key is also set to 1, it allows you to use a Friendly UI on a computer joined in a domain:

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

Script to install all print drivers on Citrix or Terminal Server

Tue, 25 Jan 2011 15:24:14 +0000

I wrote a PowerShell script to install all printer drivers on a Citrix or Terminal Server.

Actually the script isn’t specific to Citrix or Terminal Server but on such environments we need to preload all drivers because users do not have the permissions to do that.

I have chosen for PowerShell because you can do it in a one-liner which makes it easy to run this script from my Altiris server on all Citrix Servers.

The idea is that we enumerate all the shared printers on a Printer Server and make a connection to each printer. This will make sure that the driver is installed if it wasn’t already present.

The script could even be scheduled to enforce that newly added printer drivers are added to each Citrix Server.

SasLibEx Screencast

Wed, 19 Jan 2011 22:36:44 +0000

I just recorded a SasLibEx Screencast, it shows some of the very powerfull features of SasLibEx.

The following features are shown:

Simulate Ctrl Alt Del (Secure Attention Sequence)
Cancel Ctrl Alt Del
Lock Workstation
Unlock Workstation (without credentials)
Disable Ctrl Alt Del
Enable Ctrl Alt Del again
Cancel pending UAC request
Is Desktop Locked

SasLibEx Feature Demo #1

1 Comments

Tweets die vermelden SasLibEx Screencast | Remko Weijnen's Blog (Remko's Blog) -- Topsy.com Jan 20, 2011
[...] Dit blogartikel was vermeld op Twitter door Remko Weijnen, Remko Weijnen. Remko Weijnen heeft gezegd: First #SasLibEx ScreenCast! showing simulate ctrl alt del, unlock workstation without credentials, disable cad and more http://bit.ly/fFM8wB [...]

Self Signing Word Macro’s

Wed, 12 Jan 2011 15:45:51 +0000

Today I noticed that a recently added Application to the Citrix Test environment added a Macro to the Office Startup directory.

When a user launches Word he will get a popup because the Template (.dot file) was not signed:

It would have been a lot easier if Application Vendors sign their stuff because in that case I could have just added the certificate using Group Policy (yesterday’s post describes how to do this).

Application Vendors usually tell you that you should lower the Macro security in Office (or Word in this case) to Low to get rid of this message. But I think there’s a better solution: we will sign the .dot file ourselves!

Java Webapplication, certificates and Citrix

Tue, 11 Jan 2011 15:23:47 +0000

Yesterday I created an Unattended Installation of a webapplication. Of course it was “just a web link” and the application vendor usually says: you don’t need to install it just go the URL and that’s it.

The reality is usually that you go to the URL and need to install several (ActiveX) components and maybe other dependencies such as Java.

While a user may have the permissions for this on his own pc, on a Citrix or Terminal Server environment this is highly unlikely.

So we need to package and pre-install this for the users.

Nothing special so far but this particular application had some special things that were interesting enough to blog about.

So let’s start with what happened, I visited the URL of an application called Centric Key 2 Financien.

First I got a few popups with Certificates that needed to be accepted:

The application’s instructions say that the user must accept this and set the “Always trust content from this publisher” checkbox.

Paging file and Memory Dump

Fri, 07 Jan 2011 13:45:55 +0000

I often hear that people configure the Paging File (on Citrix or Terminal Servers) on a seperate volume but, the reasons is either performance or the chance that the Paging File might corrupt the volume.

However if at some point you would like to create a Memory Dump you must have a paging file on the boot volume.

Default User Profile: Remko’s solution

Tue, 04 Jan 2011 15:46:18 +0000

If you are implementing a Citrix, Terminal Server or even just a plain Client-Server environment you will need to create a Default User Profile at some point.

The Default User Profile can be thought of as the initial registry settings that are used when a new profile is created.

Many people think that the Default User Profile is available in regedit via HKEY_USERS.Default but this is NOT the Default User Profile.

Terminal Server Remote Keyboard Layout

Mon, 27 Dec 2010 16:38:55 +0000

Today I shadowed a user’s session in Citrix and when I wanted to type something I noticed that the keyboard layout was incorrect.

This is and old “friend” that I always tend to forget about. So hopefully this post will help me to remember it :D.

You can prevent this by adding a value “IgnoreRemoteKeyboardLayout” to the registry key HKLM\System\CurrentControlSet\Keyboard Layout:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v IgnoreRemoteKeyboardLayout /t REG_DWORD /d 0x00000001 /f

This option has been present since Windows 2000 but was broken in Windows 2003. For Windows 2003 there are two related hotfixes, see kb 842136 and kb 917910.

Default Explorer View

Sun, 19 Dec 2010 14:40:40 +0000

As you probably know there are several different Folder Views in Windows Explorer:

The Explorer keeps tracks of the last used View per Folder in the registry in the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags. This KB article sort of desribes this functionality.

Copying files larger than 2GB in an RDP Session

Wed, 15 Dec 2010 14:00:50 +0000

Just had a good laugh while reading Microsoft KB article 2258090:

When you try to copy a file that is larger than 2 GB over a Remote Desktop Services or a Terminal Services session through Clipboard Redirection (copy and paste) by using the RDP client 6.0 or a later version, the file is not copied. And, you do not receive an error message.

Writing Environment Variables to the Registry from a Script

Mon, 13 Dec 2010 20:52:59 +0000

I usually change the text below the “This Computer” icon to reflect the current username and servername:

This is an ancient trick, just set the the LocalizedString Value of the following key:

batch Download

HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}

to “%USERNAME% on %COMPUTERNAME%”.

It get’s a little more complicated if you want to set this from a script, because the environment variables are replaced with the actual value BEFORE they are entered in the Registry.

Automatically Accept Shadow Request

Fri, 22 Oct 2010 17:04:00 +0000

When you request Shadow (Remote Control) of a Remote Desktop (Terminal Server) or Citrix session the user gets a Dialog where he can Accept or Deny the Shadow Request.

It looks something like this:

It’s possible to change the default settings and remove the need for this permission but I think this is a bad idea since it violates the user’s privacy.

But sometimes it would be convenient to automatically accept, for instance for when a user is away or when you want to shadow a session that is “yours” but runs under another account.

I wrote a tool to do just that :D

Removing the Uninstall or change a program button from the Explorer Command Bar

Wed, 25 Nov 2009 10:52:13 +0000

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2).

This Command Bar shows possible tasks or actions depending on the active folder. I wanted to remove the “Uninstall or change a program” (in Dutch this is called “Een programma verwijderen of wijzigen”) button from the Computer view:

Adding a Printer Connection with an alternative driver

Mon, 16 Nov 2009 10:59:13 +0000

I needed to add a printer connection to a Citrix server but the problem was that this printer had a buggy driver. I wanted to use an alternative driver such as the Citrx Universal Printer driver but on Terminal Server you might want to use the Terminal Services Easy Print driver.

So I decided to make something that could be used in both situations, the result is a small commandline tool called AddPrinter2 (sorry I am not good in finding original names).

It takes 2 parameters: the printername as unc path and the driver name. An example would be:

AddPrinter2 “\server\printer” “Citrix Universal Printer”.

Small LaunchRDP Update

Fri, 06 Nov 2009 22:44:27 +0000

For a long time now people have asked for a version of LaunchRDP that includes the Connection Bar. The original version was originally written for a very specific purpose and I never anticipated so many people would want to use it. But it seems that a lot of people like the Connection Bar (I hate it, especially with sessions in sessions, so that’s why I am using RDPWithLocalTaskbar).

Delegated Management Console

Fri, 12 Jun 2009 21:40:20 +0000

In this topic I just want to show(case) you something I created in the past. It is a management console that enables delegated management in a Terminal Server or Citrix environment.

The console is launched by a small executable that check credentials (based on group membership) and then launches an RDP session with the actual console in it. The logic behind it is that the RDP session runs with an account with delegated permissions in Active Directory and the actual user account that logs in here doesn’t have any permissions at all.

This is the login screen:

If you’ve passed the login screen you enter the Main Console which consists of a Treeview on the left with possible options and a work area on the right:

Modifying Microsoft Updates and/or hotfixes

Tue, 12 May 2009 13:53:34 +0000

As you might know Microsoft distributes updates and hotfixes with in installer, update.exe. When you run update.exe it looks into the supplied .inf files to see what it has to install. It’s not possible to make changes to the inf files however because that will invalidate it’s signature (and update.exe checks the signature that is stored in an accompanying .cat file).

In my case I wanted to deploy the MUI pack for Internet Explorer 7 to be able to support multiple languages. By default this pack installs 35 (!) languages and I wanted to install only Dutch language on top of existing English.

Unable to get System PTE individual lock consumer information error when using !sysptes 4 in WinDbg

Thu, 16 Apr 2009 16:07:07 +0000

A few days ago I was troubleshooting some strange problems on a Citrix Server. After some investigation (I will write about that later) it was clear to me that there was a shortage of System Page Table Entries (PTE’s). Using perfmon you can see how many free System PTE’s are available:

Any value below 5000 is not good, values below 2000 are critical. In my case it wasn’t possible to view processes with Task Manager anymore.

Next I used WinDbg and attached to the Kernel (you can do that with File | Kernel Debug | Local | OK) and issued the !vm command:

WinDbg shows us a warning that a lot of PTE allocations have failed, we can also see that there’s enough Paged Pool and Non Paged Pool available.

So how do we find the guilty driver (usually it’s a driver)?

Sending Ctrl-Alt-Del / Simulate SAS in Windows Vista

Mon, 30 Mar 2009 21:51:48 +0000

Existing code to simulate the Secure Attention Sequence (SAS),which most people refer to as control alt delete or ctrl-alt-del, no longer works in Windows Vista. It seems that Microsoft offers a library that exports a function called SimulateSAS(). It is not public and one is supposed to request it by sending a mail to saslib@microsoft.com. Mails to this address remain unanswered though.

TSAdminEx Features Part 3

Wed, 25 Feb 2009 13:08:31 +0000

Beta Release

Part 1

Part 2

This is part 3 of the TSAdminEx Features series. Today I will discuss the Process View. As usual we will start by comparing TSAdmin to TSAdminEx again. So let's look at TSAdmin Process View:

And the one from TSAdminEx:

TSAdminEx Features Part 2

Tue, 24 Feb 2009 10:17:07 +0000

Part1

Now that a TSAdminEx beta is ready I will be showing you some features. In this part I will show the Sessions View.

Let’s start again with a compare of TSAdmin and TSAdminEx:

As you can see TSAdminEx shows more details, it shows the following extra columns:

TSAdminEx Features Part 1

Mon, 23 Feb 2009 16:18:28 +0000

Part 2

Now that a TSAdminEx beta is ready I will be showing you some features. In this part 1 I will be comparing the Users view to TSAdmin.

Let’s start TSAdmin, this tool is present by default on Windows 2003. If you use Windows XP or Windows Vista you can get it by installing the Administration Pack. Please note that TSAdmin does not work on Vista RTM due to a bug that was corrected in Vista SP1 (TSAdminEx works fine on both RTM as well as SP1)

Now let’s open TSAdminEx and start comparing…

TSAdminEx Beta release

Fri, 20 Feb 2009 17:59:06 +0000

Over the last months I have been working hard on TSAdminEx and now, finally, I can now present a first beta release.

If you don’t know what TSAdminEx is let me briefly introduce it. TSAdminEx is a tool that combines functionality of several existing tools: it has the power of task manager combined with the details of Process Explorer and the Terminal Server support of TSAdmin. On top of that it fully supports remote systems out of the box without installing any agents or services. It also has some unique features that neither of the mentioned tools can do!

Several new features have been implemented since the last time I talked about TSAdminEx and I will show you the most exciting ones here:

Accessing kernel objects in other sessions part 1

Tue, 27 Jan 2009 19:43:52 +0000

As you know, many kernel32.dll functions, which are working with named objects, like OpenEvent, can be used to work with global and local objects. So what are global and local objects? Global objects are created in session 0 and are actually located in the \BaseNamedObjects directory, while local objects are created in the caller’s session (for example in the \Sessions\5\BaseNamedObjects directory (for session 0, global and local has no meaning since they point to the same object)). MSDN says that you can access only the objects in your own session(via the Local</strong> prefix) and in session 0 (via the Global</strong> prefix). But what if you need to access an object in another session?

Windows XP x64 Terminal Server Patch part 2 (optional)

Fri, 16 Jan 2009 00:32:05 +0000

In part 1 I’ve showed how to get rid of some terminal server restrictions on Windows xp x64. But there are still some problems:

You cannot connect to the localhost (127.0.0.1) (but can to 127.a.b.c, where a,b,c in [0..255] (except 127.0.0.0 and 127.255.255.255)).

When you’re connecting to remote server, Remote Desktop Connection (mstsc.exe) checks through mtscax.dll that you’re connecting to your own address, connections are only allowed and you’re in the server mode. If this is not true, the connection is denied, usually with this message: . The logic of checking is the same: call gethostbyname for server name and check if it’s not equal to 127.0.0.1.

Windows XP X64 Terminal Server patch part 1 (mandatory)

Fri, 19 Dec 2008 13:58:17 +0000

Windows XP X64 shares the same binaries with Windows 2003 X64, but Terminal Server has some restrictions on XP. This article shows you how to get rid of them and is based on cw2k ideas from the original Windows XP Terminal Server patch.

Version 1.1 contains bug#1 fix and is smaller (less bytes are changed).

1) Winlogon.exe contains a function, called EnumerateMatchingUsers which in turn calls IsProfessionalTerminalServer function. We need to patch this function to return zero (false):

.text:0000000100042F77 IsProfessionalTerminalServer proc near ; CODE XREF: EnumerateMatchingUsers:loc_10002B44Bp .text:0000000100042F77 ; DATA XREF: .pdata:00000001000D01DCo ... .text:0000000100042F77 .text:0000000100042F77 VersionInformation= _OSVERSIONINFOW ptr -138h .text:0000000100042F77 var_20 = word ptr -20h .text:0000000100042F77 var_ 1E = byte ptr -1Eh .text:0000000100042F77 var_18 = qword ptr -18h .text:0000000100042F77 .text:0000000100042F77 48 81 EC 58 01 00 00 sub rsp, 158h => 31 C0 C3 xor eax, eax; retn .text:0000000100042F7E 48 8B 05 F3 3A 08 00 mov rax, cs:__security_cookie .text:0000000100042F85 48 89 84 24 40 01 00 00 mov [rsp+158h+var_18], rax .text:0000000100042F8D 48 8D 4C 24 20 lea rcx, [rsp+158h+VersionInformation] ; void * .text:0000000100042F92 33 D2 xor edx, edx ; int

Globally disable Flash Player autoupdate

Fri, 19 Dec 2008 09:06:16 +0000

On a Citrix or Terminal Server you will want to disable autoupdate notifications of the flash player.

This can be done by creating a file mm.cfg in the folder where the flash ActiveX control is installed (normally C:\Windows\System32\Macromed\Flash).

Place the following line in this file (with a text editor like Notepad):

Locking a workstation - part 1

Sat, 13 Dec 2008 23:13:08 +0000

Win32 API provides only 1 function for locking workstation, named LockWorkstation. What does it do and how we can use it?

When a new session is started, smss.exe invokes winlogon.exe. It registers its process id in win32k.sys by calling RegisterLogonProcess. It has this prototype:

Windows 2003 X64 Terminal Server Patch

Tue, 09 Dec 2008 13:53:39 +0000

A while ago I published a patch for Windows 2003 Terminal Server that allows more than 2 concurrent sessions in Remote Administration mode.

Today I publish the same patch but for Windows Server 2003 X64. The patched function (CRAPolicy::Logon) is the same as in the original patch.

Executing a Fast User Switch programmatically - part 2

Wed, 26 Nov 2008 16:45:46 +0000

Part1

Let’s write our own Credential Server implementation.

At first, we need to create a named pipe with a unique name. Let’s construct the pipe name using a GUID - this should be unique, but we can do it in a cycle to be absolutely sure:

Executing a Fast User Switch programmatically - part 1

Wed, 26 Nov 2008 15:23:37 +0000

I think many of you have got experience with multiple Terminal Server Sessions in windows XP, also called Fast User Switching (FUS). Let’s get inside this cool feature.

How does FUS work? Each session has its own winlogon.exe. It draws the same interface which looks like the screenshot below:

Terminal Server Internals

Wed, 19 Nov 2008 17:55:39 +0000

Hello, my name is Danila Galimov and i will write here sometimes :-)

My first post is about communications between Terminal Server sessions and Terminal Server service process (termsrv.exe/dll). Terminal Server service needs to communicate with each session for many tasks, such as sending window message, getting message reply and so on. So, on init, Terminal Server creates a SmSsWinStationApiPort port in global namespace and runs a few WinStationLpcThread threads, which are listening on port and are used to process port messages. When csrss.exe is started, it parses its command line, which usually looks like:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=4096,4096,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
and loads the required dlls (winsrv.dll in our case). Initialization of winsrv.dll creates a thread, which connects to SmSsWinStationApiPort port and does the loop for processing Terminal Server messages until it receives WinStationTerminate message.
We’ll try to fool Terminal Server

RDP Session with Local Taskbar visible

Sun, 02 Nov 2008 08:16:42 +0000

I usually have lots of Terminal Server sessions open when I’m working, both direct sessions but also “sessions in sessions”. In order to keep overview on my desktop I prefer to make the session size as big as possible without being full screen (so keep my local taskbar visible).

If I run a session in a session I do this again, this makes switching sessions very easy and you can always see which session you are in:

Patch Windows 2008 Terminal Server to allow more than 2 concurrent sessions

Tue, 21 Oct 2008 13:56:23 +0000

Well it took some time but I patched Terminal Server for Windows 2008 to allow unlimited sessions in Remote Administration mode.

This patch is for 32 bit English version. In order to install it you need to perform the steps below. Before you start please check if using this patch is allowed according to your country’s law and your license agreement.

Patch Windows 2003 Terminal Server to allow more than 2 concurrent sessions

Sun, 31 Aug 2008 07:19:48 +0000

As you might know Windows 2003 Server accepts at most 2 concurrent Terminal Server sessions (and 1 console session) in Remote Administration mode (which is the default). Of course if you switch to Application Mode you can have an unlimited number of sessions but this requires licenses and a license server.

When Terminal Server creates a new session it checks if the new session is either a console session or a help assistant session and if not it allocates a license. The function that performs this check is called CRAPolicy::Logon

Multiple Concurrent Terminal Server Sessions On Vista SP1

Sat, 14 Jun 2008 23:35:44 +0000

There are several patched terminal server dll’s floating around in the net to allow multiple concurrent Terminal Server session on Windows Vista with Service Pack 1. But they all have the same limitations:

It’s not possible to start a session to Localhost, this is because the Terminal Server client does a check to see if you are running Personal Terminal Server (Vista/XP) and denies Localhost or 127.0.0.1 if true (127.0.0.2 works though).

Terminal Server Ping Tool

Fri, 13 Jun 2008 13:34:46 +0000

A while ago I included a new undocumented API into my JwaWinsta unit which is called WinStationServerPing. This API “pings” a Terminal or Citrix server and verifies that Terminal Server is up and running. It is not the same as a regular networking ping! This API actually makes a connection to a (remote) Terminal Server and verifies that Terminal Server runs and accepts connections.

I wrote a small cmdline tool that uses this API to ping a Terminal Server which can be used to quickly determine if a Terminal Server is up and running. I named it WTSPing.

So how does it work? Open up a command prompt (Start -> Run -> cmd) and type WTSPing /? to see the help:

How rdp passwords are encrypted 2

Sun, 02 Mar 2008 23:28:57 +0000

Several months ago I wrote about encrypting and decrypting RDP passwords. I left one thing open: encrypting the password up to the full 1329 bytes as mstsc does.

Many people were curious about it so I hope the answer is not a disappointment because it’s actually really simple (but I took me a while to figure that out nonetheless). In what I figure is an attempt to hide the password length mstsc always fills up the password with zeroes until it has 512 bytes length.

Vista SP1 changes to Terminal Server API

Sun, 02 Mar 2008 15:31:55 +0000

In a previous article I wrote about changes in utildll in vista that breaked compatibality for Terminal Server. Even though release notes for Service Pack 1 don’t indicate changes or fixes in this area my testing shows that Microsoft has taken over the Windows 2008 implementation of utildll to Vista.

Supporting for in loop in TObjectList descendants

Sun, 02 Mar 2008 15:08:19 +0000

For my Terminal Server unit in the Jedi Security library I use 2 TObjectList descendants to hold a list of Terminal Server Sessions and Processes. Consider the sample below which connects to a server and enumerates all sessions:

objectpascal Download

var ATerminalServer: TJwTerminalServer; i: Integer; begin ATerminalServer := TjwTerminalServer.Create; ATerminalServer.Server := 'TS001'; try if ATerminalServer.EnumerateSessions then begin // Now loop through the list for i := 0 to ATerminalServer.Sessions.Count - 1 do begin Memo1.Lines.Add(ATerminalServer.Sessions[i].Username); end; end; except on E: EJwsclWinCallFailedException do begin // Handle Exception here end; end; // Free Memory ATerminalServer.Free; end;

In the sample I loop through the sessions with a for loop. Even though Delphi supports the for in loop since Delphi 2005 it's not possible to use this in TObjectList descendants, so we cannot use this:

objectpascal Download

// Now loop through the list for Session in ATerminalServer.SessionList do begin Memo1.Lines.Add(Session.Username); end;

To make this possible we need to implement GetEnumerator and an Enumerator class:

objectpascal Download

TJwSessionsEnumerator = class private FIndex: Integer; FSessions: TJwWTSSessionList; public constructor Create(ASessionList: TJwWTSSessionList); function GetCurrent: TJwWTSSession; function MoveNext: Boolean; property Current: TJwWTSSession read GetCurrent; end; constructor TJwSessionsEnumerator.Create(ASessionList: TJwWTSSessionList); begin inherited Create; FIndex := -1; FSessions := ASessionList; end; function TJwSessionsEnumerator.GetCurrent; begin Result := FSessions[FIndex]; end; function TJwSessionsEnumerator.MoveNext: Boolean; begin Result := FIndex < FSessions.Count - 1; if Result then Inc(FIndex); end;

Now we add a function with the name GetEnumerator in the SessionList class:

objectpascal Download

function TJwWTSSessionList.GetEnumerator: TJwSessionsEnumerator; begin Result := TJwSessionsEnumerator.Create(Self); end;

And that's really all!

1 Comments

  Remko shows us how to use the Terminal Server feature of JWSCL by JEDI Windows API Mar 3, 2008
[...] Go and learn more about it here. [...]

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Why TSAdmin crashes on Windows Vista

Wed, 19 Dec 2007 21:38:39 +0000

Have you ever tried running the Terminal Server Administration tool (aka TSAdmin) on Windows Vista? You would need it to remotely administer windows 2000/2003 Terminal Servers. If you try to run it you will get an Access Violation but why? I found the answer to this question today because I was testing my TSAdmin replacement on different Windows versions. Just like TSAdmin I use an (undocumented) function from Utildll.dll called ElapsedTimeString. It’s a very simple function that returns a formatted elapsed time string (as seen in the Idle time column from TSAdmin).

Undocumented API's from Utildll

Sun, 09 Dec 2007 11:05:04 +0000

Several of Microsoft’s Terminal Server tools use undocumented API’s from Utildll.dll. For instance Terminal Server Admin uses it to get a localised connect state string and to format time strings like idle time, logon time etc.

Functions below seems to be the most usefull ones, I will add those to the JwaWinsta unit:

Delphi and Terminal Server Aware

Sat, 24 Nov 2007 23:21:37 +0000

When an application is not Terminal Server aware (also known as a legacy application), Terminal Server makes certain modifications to the legacy application to make it work properly in a multiuser environment. For example, Terminal Server will create a virtual Windows folder, such that each user gets a Windows folder instead of getting the system’s Windows directory. This gives users access to their own INI files. In addition, Terminal Server makes some adjustments to the registry for a legacy application. These modifications slow the loading of the legacy application on Terminal Server and require up to 8 MegaBytes extra memory. This behaviour can be avoided if the TSAware flag is present in the PE header of an executable as can be read here at MSDN.

Multiple Terminal Sessions in Windows Vista

Wed, 21 Nov 2007 18:09:47 +0000

There were 2 ways (known to me) of extending Windows XP to offer mulitple concurrent Terminal Sessions. One with the RC1 version of XP SP2 and one that patches Winlogon and Termsrv.dll. The latter offers not only multiple sessions but also multiple sessions under the same account and sessions to the local machine.

More undocumented Terminal Server API's

Fri, 09 Nov 2007 22:42:58 +0000

I added some more undocumented API’s to my Jwawinsta unit, the unit is now becoming a collection of the undocumented API’s in winsta.dll.

These are the functions I added:

WinStationDisconnect

WinStationGetProcessSid

CachedGetUserFromSid (exported by utildll.dll)

I also added some more parts of the undocumented structure returned by WinStationQueryInformationW, it now contains:

Session State

WinStationName

SessionId

ConnectTime

DisconnectTime

LastInputTime

LogonTime

OutgoingFrames

OutgoingBytes

OutgoingCompressedBytes

IncomingCompressedBytes

IncomingFrames

IncomingBytes

Domain

Username

CurrentTime

2 Comments

Chris Dec 3, 2007
I would like know how it is possible to access WindowStation and Desktops from a service.
CreateDesktop and similar only works for the current session of the process.
I know there exists NTQueryObject and similar but they are hard to understand and only query kernel objects.
However creating a desktop from a service into another session is a mystery.

Terminal Server Client annoyances

Fri, 09 Nov 2007 21:39:50 +0000

If you want to get rid of this message:

Remote Desktop cannot verify the identity of the computer you want to connect to. This problem can occur if:

The remote computer is running a version of Windows that is earlier than Windows Vista.

The remote computer is configured to support only the RDP security layer.

Contact your network administrator or the owner of the remote computer for assistance.

Citrix Solutions Conference 2007

Thu, 08 Nov 2007 15:01:24 +0000

Yesterday I attended the Citrix Solutions Conference in Antwerp. Brad Pedersen (Chief Architect and Senior Fellow at Citrix Systems) held an interesting speech about The End User Experience. I liked especially liked the part about the history of Citrix and the early versions of their products like Wincredible and Winframe. Since Brad wrote the original code for Citrix and thus Terminal Server (the stuff that is in winsta.dll now) I hoped he could share some info with me on the undiscovered parts of winsta.dll. Unfortunately Brad could not do this because of a non disclosure agreement with Microsoft. He did tell me that Citrix is pushing Microsoft to make more Terminal Server API’s public. I presume that’s why Vista and Windows 2008 offer some new API’s which I wrote about earlier.

How to launch a process in a Terminal Session #2

Thu, 08 Nov 2007 13:48:18 +0000

A little while ago I wrote an article on launching a process in another Terminal Session (/2007/10/20/how-to-launch-a-process-in-a-terminal-session/).

The article didn’t have a demo app yet so I’ve attached it here.

How to get Client IP Address?

Wed, 31 Oct 2007 11:10:10 +0000

When a client is connected to a Terminal Server Session you can use the Terminal Server API to retrieve the client’s local IP address.

Start by enumerating all sessions with WtsEnumerateSessions and then for each session get the ClientAddress with a call to WTSQuerySessionInformation with the WTSClientAddress parameter. Sound simple, no?

WTSQuerySessionInformation returns a pointer to a WTS_CLIENT_ADDRESS structure. You need to know that the IP address is located at on offset of 2 bytes in the Address member of WTS_CLIENT_ADDRESS.

So here’s a sample:

New Terminal Server API's in Vista SP1

Tue, 30 Oct 2007 22:19:25 +0000

The upcoming Vista SP1 promises 3 new Terminal Server API functions:

WTSConnectSession : Connects a Terminal Services session to an existing session on the local computer.

WTSStartRemoteControlSession: Starts the remote control of another Terminal Services session.

WTSStopRemoteControlSession : Stops a remote control session.

If you look in the Windows 2008 beta you can see that the functions are already implemented (in WtsApi32.dll):

RDP Clipboard Fix

Thu, 25 Oct 2007 17:45:57 +0000

Did you ever loose Clipboard functionality (copy/paste) while working with several Terminal Server sessions? I think everyone that works a lot with Terminal Server has experienced this from time to time.

It’s caused by badly behaving applications. Dimitry Vostokov wrote a tool to fix this issue for Citrix (RepairCBDChain.exe), he explains the issue very well on his blog:

Windows has a mechanism to notify applications about clipboard changes. An application interested in such notifications has to register itself in the so called clipboard chain. Windows inserts it on top of that chain and that application is responsible to propagate changes down the chain:

If 3rd-party application forgets to forward notifications down then we have a broken clipboard chain and clipboard changes are not sent via ICA protocol:

Read more at Dimitry’s Blog: http://citrite.org/blogs/dmitryv/2006/12/09/clipboard-issues-explained/

So how can we fix this for Terminal Server then?

TSAdminEx

Tue, 23 Oct 2007 19:48:50 +0000

You will probably know Microsofts Tool to Manage Terminal Server, it’s called Terminal Services Manager (you will probably know it as TSAdmin). It can be used to view information about terminal servers including all sessions, users, and processes for each terminal server.

I’m currently working on a TSAdmin replacement (codename TSAdminEx). Purpose is to show how to use the Terminal Server API’s and as a little bonus we will add some extra functionality to TSAdminEx.

How to launch a process in a Terminal Session

Sat, 20 Oct 2007 22:45:24 +0000

This is an often asked question but the solution is simple:

So how does it work?
First we obtain the user’s primary access token with the WtsQueryUserToken API call. To call this function successfully, the calling application must be running within the context of the LocalSystem account and have the SE_TCB_NAME privilege (LocalSystem has this privilege by default). Since the function returns a primary acces token we can just pass this to CreateProcessAsUser and voila!

How rdp passwords are encrypted

Thu, 18 Oct 2007 21:23:17 +0000

Ever wondered how mstsc saves passwords? If you open an RDP file with a text editor like Notepad you can see the encrypted password. In this article I will show you how to encrypt and decrypt these passwords. Besides password recovery this enables you to create rpd files programmatically or perhaps update the password in many rdp files with a batch file.

Launch RDP from commandline

Wed, 17 Oct 2007 22:47:53 +0000

A little while ago I wrote a little commandline tool that starts an RDP connection (with mstsc.exe) because mstsc doesn’t allow you to use the login credentials (username, password) as commandline arguments.

Arguments are:

Servername (string)

Port (integer, usually 3389)

Username (string)

Domain (string)

Password (string)

Console (integer, specify 0 for false and 1 for true)

RedirectDrives (integer, specify 0 for false and 1 for true)

RedirectPrinters (integer, specify 0 for false and 1 for true)