Microsoft RDP and Terminal Services info

Random session disconnects in Windows 11 22H2:

https://learn.microsoft.com/en-us/answers/questions/1021754/windows-11-remote-desktop-frequent-disconnects

Configure “Use only TCP” in Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections

Configure “Turn Off UDP On Client” in Computer Configuration > Administration Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client

Query and reset RDP session on remote PC:

Query:
qwinsta /server:IP/servername
Reset:
rwinsta SESSIONID /server:IP/servername

Configure RDP shadowing in Windows 10/11:

https://winitpro.ru/index.php/2018/07/11/rdp-shadow-k-rabochemu-stolu-polzovatelya-windows-10/

Expired certificate warning while connecting to Windows machine using RDP:

Looks like latest Windows 2022 and 11 updates broke certificate reissuing mechanisms. It can be seen as expired certificate warning when connecting with RDP to windows machine.
According to this manual: https://docs.rackspace.com/docs/rdp-connection-failures-expired-self-signed-certificate the problem is with the “f686” file/ It shoud be replaced with the new one by Remode Desktop Services when needed, but somewhy it is not being replaced.
With help of this manual  https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753525(v=ws.10)?redirectedfrom=MSDN I created Powershell script that can be placed in domain Group Policy and started at next reboot or this script can be manually run by admin on the machine that needs this fix:

Fix-Expired-RDP-Certificate.ps1:
net stop "TermService" /y
takeown /F "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*"
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" /grant administrators:F /t
Get-ChildItem "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" | foreach{ Rename-Item $_.FullName -NewName ($_.FullName + "-old")}
net start "TermService" /y

I prefer to keep old files and not delete them, but here is a tested broken f686* remove command just in case:
Remove-Item -Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" -Force

Enable saving passwords in RDP Web App:

“In .rdp file remove string workspace id:s:

and enjoy a perfectly working RemoteApp with password saving.”
https://social.technet.microsoft.com/Forums/ru-RU/6bce67f0-b7e6-4c79-9cbc-f1f14425b5b7/-remoteapps?forum=WS8ru

Windows RDP tuning:

Enabling WRSM in Windows Server 2012 R2 to manage resouses used by each user:
https://www.vioreliftode.com/index.php/windows-system-resource-manager-and-windows-server-2012-r2/

Enabling multiconnection in windows 7, 8.1, 10:
https://github.com/stascorp/rdpwrap
https://winitpro.ru/index.php/2015/09/02/neskolko-rdp-sessij-v-windows-10/

PDF printer supported via RDP:

https://www.bullzip.com/products/pdf/info.php

RDWeb error error CS0016: Could not write to output file ‘c:\Windows\Microsoft.NET\Framework64\’

error CS0016: Could not write to output file ‘c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files

Grant local IIS_Users group r/w access to temp dir.

Firefox

Restore previous session after closing Firefox windows and leaving another window open:
– close Firefox and/or don’t open if you just find that you’re in trouble
– go to %AppData%\Mozilla\Firefox\Profiles\YOUR-PROFILE
– find sessionstore.jsonlz4 and rename if to sessionstore.jsonlz4-old
– go to %AppData%\Mozilla\Firefox\Profiles\YOUR-PROFILE\
– copy all files from there to some temporary directoy
– copy one of those files to %AppData%\Mozilla\Firefox\Profiles\YOUR-PROFILE
– rename that copied file to sessionstore.jsonlz4
– try to open Firefox and see if your tabs are restored
– if not or not all, try another file

There is a good tool to recover information from the .jsonlz4:
https://github.com/avih/dejsonlz4

Windows troubleshooting

The Print Spooler service terminated unexpectedly:

net stop spooler
del %systemroot%\system32\spool\printers\*.shd
del %systemroot%\system32\spool\printers\*.spl
net start spooler
https://it.ros-kit.ru/help/computers/kak-ochistit-ochered-pechati/

Fix DHCP service cannot start: error 5: Access Denied:

https://www.wintips.org/how-to-fix-dhcp-service-cannot-start-access-is-denied/

Windows Update Error 0x80070422 while installing standalone update .msi:

– windows update service not running. Start it manually before installing .msi.

Windows 10 20H1 update error 0x8007001f MIGRATE_DATA:

Stop Windows Update
Remove c:\windows\SoftwareDistribution\Downloads
Remove c:\Windows_BT
Check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. If the value in ProfilesDirectory is not set as default %SystemDrive%\Users, set it like this temporary, update Windows, and change back as it was before update.
Reboot.
https://superuser.com/questions/1602404/win10-upgrade-to-version-20h2-failed-how-to-determine-the-cause

Install Windows 11 on unsupporterd hardware:

Fresh install with boot from original ISO:
After getting error about unsupported hardware press Shift + F10, then type “regedit” in CMD window
Go to HKEY_LOCAL_MACHINE\SYSTEM\Setup
Create key “LabConfig”
Create DWORD BypassTPMCheck, BypassSecureBootCheck, BypassRAMCheck, BypassCPUCheck with “1” in each
Close regedit and CMD
Go back in setup window and continue the installation.
https://adminwin.ru/oshibka-this-pc-doesnvt-meet-the-minimum-system-requirements-to-install-this-version-of-windows/

Updating existing installation to Windows 11:
Extract install.wim from Windows 11 ISO
Open Windows 10 .ISO equal to Windows 11 .ISO you’ve decided to install with any CD image editor like UltraISO. Replace ./Sources/install.wim with install.wim from Windows 11 .ISO. Save with decided name.

Domain controller Kerberos login/password errors

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/domain-controller-not-functioning-correctly

If you experience this symptoms:
– your secondary DC can’t resolve DNS names
– you see “Audit Failure” event ID 4625 with the name of your secondary DC in event viewer on your promary Domain Controller

Check that you have right Kerberos realm on the secondary DC in HKEY_LOCAL_MACHINE\SECURITY\Policy\PolPrDmN
Aquire Kerberos password change from Primary DC:
netdom resetpwd /server: /userd:domain\administrator /password:

“Cannot connect to the DRIVELETTER$ admin share to verify if folder YOURDECIDEDSHAREDFOLDER exists on computer COMPUTERNAME” error while configuring NFS share:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/problems-administrative-shares-missing
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
If the AutoShareServer and AutoShareWks DWORD values in the LanmanServer\Parameters subkey are configured with a value data of 0, change that value to 1.

Error 0x800ccc14 in Outlook 2021 while creating new user profile:

https://answers.microsoft.com/ru-ru/windows/forum/all/после/fe32ecfd-2d08-43ae-91f9-401bda3ee803
If you’ve installed CryptoPRO before creating user profile in Outlook you’ll get this error. Remove the CryproPRO shit and create a profile without errors.

If “Send to” menu item disappeared

Copy %userprofile%\AppData\Roaming\Microsoft\Windows\SendTo from the user’s profile that hasn’t disappeared.
Or restore Send To folder default contents:

Open install.wim from “sources” folder of install .iso
Copy 3\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\ to %userprofile%\AppData\Roaming\Microsoft\Windows\SendTo of user thar has Send To item disappeared.

Disable beep Windows 8/8.1/10/2012

net stop beep
sc config beep start= disabled

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Beep

Start = 0x00000000
HKEY_CURRENT_USER\Control Panel\Sound
beep = no

Windows Update 80070003 error, if Server 2012 R2 do not want to update

net stop wuauserv

DISM /Online /Cleanup-Image /RestoreHealth

If there is an error ” The source files could not be downloaded”:

gpedit.msc

Computer Configuration > Administrative Templates > System

Specify settings for optional component installation and component repair setting

Contact Windows Update directly to download repair content instead of Windows Server Update Service (WSUS).

or

DISM /Online /Cleanup-Image /RestoreHealth /source:WIM:X:\Sources\Install.wim:1 /LimitAccess Where “X” is the drive letter where the ISO is located. Simply change the “X” to the correct drive letter

 

sfc /scannow

shutdown /r /f

 

https://www.thewindowsclub.com/dism-fails-source-files-could-not-be-found

https://support.microsoft.com/ru-ru/help/947821/fix-windows-update-errors-by-using-the-dism-or-system-update-readiness