Tag: Terminal Services

Random session disconnects in Windows 11 22H2:

https://learn.microsoft.com/en-us/answers/questions/1021754/windows-11-remote-desktop-frequent-disconnects

Configure “Use only TCP” in Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections

Configure “Turn Off UDP On Client” in Computer Configuration > Administration Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client

Query and reset RDP session on remote PC:

Query:
qwinsta /server:IP/servername
Reset:
rwinsta SESSIONID /server:IP/servername

Configure RDP shadowing in Windows 10/11:

https://winitpro.ru/index.php/2018/07/11/rdp-shadow-k-rabochemu-stolu-polzovatelya-windows-10/

Expired certificate warning while connecting to Windows machine using RDP:

Looks like latest Windows 2022 and 11 updates broke certificate reissuing mechanisms. It can be seen as expired certificate warning when connecting with RDP to windows machine.
According to this manual: https://docs.rackspace.com/docs/rdp-connection-failures-expired-self-signed-certificate the problem is with the “f686” file/ It shoud be replaced with the new one by Remode Desktop Services when needed, but somewhy it is not being replaced.
With help of this manual  https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753525(v=ws.10)?redirectedfrom=MSDN I created Powershell script that can be placed in domain Group Policy and started at next reboot or this script can be manually run by admin on the machine that needs this fix:

Fix-Expired-RDP-Certificate.ps1:
net stop "TermService" /y
takeown /F "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*"
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" /grant administrators:F /t
Get-ChildItem "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" | foreach{ Rename-Item $_.FullName -NewName ($_.FullName + "-old")}
net start "TermService" /y

I prefer to keep old files and not delete them, but here is a tested broken f686* remove command just in case:
Remove-Item -Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686*" -Force