1 of 65

Understanding and Troubleshooting Remote Desktop Connection

2 of 65

International Telecommunication Union (ITU)

RDP is a multichannel capable protocol allowing virtual channels for:

Presentation data

Serial device communication

Licensing information

Highly encrypted data like keyboard, mouse activity

Remote Desktop is an extension of the T.120 protocol standards which is a part of the many technology standards of the ITU

3 of 65

The T.120 series of protocols

The T.120 series of protocols were established by the International Telecommunication Union (ITU) to support multipoint data communication and conferencing.

Multipoint Communication Service (MCS): RDP relies on MCS for managing sessions and data flow control. MCS allows multiple users to communicate within the same remote session.

These protocols enable data sharing, real-time application sharing, and whiteboard functionality over networks.

Components of the T.120 series include:

T.121 (Generic Application Template)
T.122/T.125 (Multipoint Communication Service - MCS)
T.123 (Network-Specific Transport Protocols)
T.124 (Generic Conference Control)
T.126 (Whiteboard Application)
T.127 (File Transfer)

4 of 65

RDC is a client-server application

It began with a company called Citrix
1997 Citrix purchase source code for Windows NT, they wanted to create a multiuser feature.
Part of the deal allowed Microsoft and Citrix to collaborate on building Windows Terminal Server
Both Citrix and Terminal Server were very successful and RDC was born.

1. IBM

Background: IBM has had access to certain parts of the Windows source code, particularly during the 1980s and 1990s, as a result of its collaboration with Microsoft on OS/2 and other operating systems.
Purpose: To develop software that was compatible with Windows and to support its hardware and software ecosystem. IBM's access to the code was primarily focused on older versions of Windows.

2. Novell

Background: Novell obtained access to some Windows source code under a settlement agreement with Microsoft. This agreement was part of a broader resolution of antitrust and competitive disputes.
Purpose: To enhance interoperability between Novell’s NetWare server software and Windows, enabling better integration and compatibility for users who relied on both platforms.

3. SCO Group (formerly Caldera Systems)

Background: SCO (The Santa Cruz Operation) gained access to some Windows source code as part of a 1996 settlement agreement with Microsoft. This was primarily for Windows 3.x and early versions of Windows NT.
Purpose: The purpose was to facilitate interoperability between SCO's Unix-based products and Microsoft Windows, and to allow SCO to develop tools that supported both Unix and Windows platforms.

4. Chinese Government Entities (China Information Technology Security Certification Center, CTCPEC)

Background: In the early 2000s, Microsoft provided access to parts of the Windows source code to the Chinese government through a controlled program known as the Government Security Program (GSP).
Purpose: To reassure the Chinese government of the security and reliability of the Windows operating system. The agreement aimed to allow Chinese officials to inspect the code to ensure it did not contain any hidden backdoors or malicious elements.

5. Russian Government Entities

Background: Similar to the arrangement with China, Microsoft provided the Russian government access to certain parts of the Windows source code under the Government Security Program (GSP).
Purpose: This access was provided to allow the Russian government to review and audit the source code for security purposes, ensuring that their national security interests were protected.

6. NATO and European Union (EU) Entities

Background: Under Microsoft's Government Security Program (GSP), some entities associated with NATO and the EU have been granted access to Windows source code.
Purpose: To provide assurance of security and to support interoperability with defense and intelligence systems that rely on Windows as part of their IT infrastructure.

7. Academic Institutions

Background: Several academic institutions worldwide have been granted access to portions of the Windows source code through special licensing arrangements with Microsoft. This is usually in the context of research and development.
Purpose: To support academic research into operating system design, security, and performance optimization, often under strict non-disclosure agreements (NDAs).

Other Notable Mentions:

Hewlett-Packard (HP) and Dell: As major OEM partners, these companies have had access to parts of Windows source code necessary for optimizing their hardware and software configurations. However, this access is typically more limited and controlled.
Various Security Firms: Some security companies have been granted limited access to specific parts of the Windows source code to help identify vulnerabilities and improve security products that integrate with or protect the Windows platform.

5 of 65

Components

Windows 11 RDC

6 of 65

Windows 11 RDC

7 of 65

IP address or Computer Name

8 of 65

Windows 11 RDC components: Remote Desktop Service

Service:

Remote Desktop Service:

This core service is responsible for managing in-coming remote desktop connections and sessions.
It handles authentication, authorization, and session management.

9 of 65

Windows 11 RDC components: Remote Desktop Service

10 of 65

*.rdp files allow mstsc.exe features to be enabled/disabled

Mstsc.exe will use the default.rdp, a hidden file in Documents

11 of 65

Client side

Executables:

mstsc.exe: This is the primary executable for the RDC client. It provides the user interface for establishing and managing remote desktop connections.
rdcman.exe: The Remote Desktop Connection Manager is an optional tool that allows users to save and manage multiple remote desktop connection profiles. (Sysinternals) Microsoft Store

13 of 65

Termsrv

Services and their dependencies

15 of 65

RDC client Certificate: Local computer

16 of 65

Inbound rules in remote host’s firewall

17 of 65

Firewall settings

18 of 65

RDC handshake between client and server

19 of 65

Remote Assistance

Many companies use Remote Assistance as part of their Help Desk Support system.
Remote Assistance uses unique components

20 of 65

Remote Assistance Protocol

This protocol is used after a Remote Assistance connection is established between two computers.
The functions supported by the Remote Assistance Protocol are session initialization, file transfer, chat (text message exchange), share control, and Voice-over-IP (VoIP) control.
This feature allows the shadowing of a user’s session

22 of 65

Remote Assistance: allows session sharing

RasAuto (Remote Access Auto Connection Manager): Manages connections and ensures that the remote helper can connect to the shared session.

Msra.exe (Microsoft Remote Assistance): The main executable that facilitates the Remote Assistance session.

RasMan (Remote Access Connection Manager): Manages the connection, allowing it to operate over various network types.

23 of 65

Sessions-Windows Stations-Desktops

24 of 65

Understanding Sessions

Sessions
Windows Stations
Desktop

25 of 65

Three desktops for each session

Default, The Default desktop is where user applications run by default
Screen-saver, The Screen-saver desktop is where Windows runs the screen saver if password protection is enabled
and Winlogon, The Winlogon desktop, also known as the secure desktop, is where Windows transfers control when you press Ctrl+Alt+Del and the default place to display UAC elevation dialog boxes.

Only programs running under “System” are associated with Winlogon desktop

26 of 65

Winobj.exe

Allows you to view sessions, Windows stations, Desktops

27 of 65

Session ID for user

28 of 65

Process assigned to session ID

29 of 65

Finding Windows Station

31 of 65

RATs

Remote Access Trojans (RATs): Hackers often use RATs, which are malware programs designed to provide remote access to the hacker. A RAT can share the same session as a logged-on user by running in the background, allowing the hacker to see and control everything the user is doing.
Top 7 RATs used by hackers

Sakula
KjW0rm
Havex
Agent.BTZ/ComRat (Russian)
Dark Comet
AlienSpy (Apple OS X)
Heseber BOT

https://www.darkreading.com/perimeter/the-7-most-common-rats-in-use-today

32 of 65

Need troubleshooting Resources now!

Links to the next two slides in our video notes

34 of 65

Windows 11 RDC server components

35 of 65

Windows 11 RDC server components

termsrv.dll (Terminal Server Remote Protocol Service DLL)

Function: Implements the core functionality of the RDC server protocol stack, allowing multiple remote desktop connections.
Type: DLL
Details: Located in C:\Windows\System32\termsrv.dll.

rdpclip.exe (Remote Desktop Clipboard Process)

Function: Provides clipboard redirection between the client and the server in an RDC session.
Type: Process

36 of 65

Windows 11 RDC server components

Function: Manages the remote desktop shell environment, providing a remote user interface and session management.
Type: Process
Details: Supports seamless windowing and session management features.

rdpshell.exe (Remote Desktop Shell)

Function: Allows multiple users to connect interactively to a computer and manage remote desktops.
Type: Service
Service Name: TermService
Details: Manages all remote desktop connections to the computer.

Remote Desktop Services (TermService)

Function: Initializes a remote desktop session, setting up the connection parameters and required environment.
Type: Process
Details: Responsible for session startup and initial configuration.

rdpinit.exe (RDP Initialization Process)

37 of 65

Windows Server 2016-2025

RDC server components

38 of 65

Windows Server 2016-2025: RDC server-side

TermService: this service runs on server
Remote Desktop Connection Broker (Tssdis.exe)Function: Manages connections to available RD Session Host servers in the farm. Supports load balancing and reconnecting a user to an existing session
Rdpinit.exe / Rdpclip.exe: critical processes that initialize the RDP session and clipboard redirection
SessionEnv (Remote Desktop Configuration Service): configures RDP settings for the server
TermServLicensing: manages RDC license (CALs) (Tssdis.exe)
AudioSrv (Windows Audio Endpoint Builder): ensures audio redirection
Tsgateway (Remote Desktop Gateway): used for HTTPS environments
Remote Desktop Web Access (rdweb.exe)Function: Provides a web-based gateway for remote desktop sessions and RemoteApps.
Listener Configuration (RDP-TCP): manages the network connection
RemoteFX and other RDP-related DLLs (e.g., rdpcore.dll, rdpbase.dll)Function: Enhances remote desktop sessions with GPU acceleration and USB redirection.

39 of 65

Windows clients: RDC not enabled

PowerShell script that will enable a client on a domain (you need to be a domain admin)

Will prompt you for variables ex: computer name (IP address)

Will display each major steps the script is taking and show success or failure.

See link in video description (the extension will be *.txt you will have to change to *.ps1)

40 of 65

Troubleshooting RDC

42 of 65

For any missing or corrupted files!

Using SFC and DISM to Repair System Files

Open an elevated Command Prompt:
Press Win + X and select Windows Terminal (Admin) or Command Prompt (Admin).
Run the SFC command: sfc /scannow
This command will scan all protected system files and replace any corrupted files with a cached copy located in the %WinDir%\System32\dllcache folder.
The process can take some time, and you should not close the Command Prompt window until the verification is 100% complete.

Step 1: Run the System File Checker (SFC)

43 of 65

For any missing or corrupted files!

Step 2: Use DISM to Repair Windows Image

If SFC cannot fix the problem, use the DISM tool to repair the Windows image:
Check the Image for Corruption: DISM /Online /Cleanup-Image /CheckHealth

This checks if the image has been flagged as corrupted.

Scan the Image for Corruption: DISM /Online /Cleanup-Image /ScanHealth

This performs a more thorough scan to detect corruption.

Repair the Image: DISM /Online /Cleanup-Image /RestoreHealth

This command attempts to repair the Windows image using files from Windows Update.
If your Windows Update client is not working or if you want to use a local source, you can specify a local repair source: DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccessReplace C:\RepairSource\Windows with the actual path to the source files.

44 of 65

Failing to connect to remote host

45 of 65

One test confirms two functions

46 of 65

Long time out…

47 of 65

Troubleshooting a remote host

Just because RDC will not work

Create a remote PowerShell session and troubleshoot

Enter-Pssession –computername <remotehost>

If this fails, verify DNS and IP address for host

Use nslookup <remote_host> or ping <remote_host> to check name resolution.

48 of 65

Scripts

You are on a domain and you are a domain admin

49 of 65

Is RDP enabled on the remote host?

Ensure that RDP is enabled and check the RDP port (default is 3389). Use the following command:

Invoke-Command -ComputerName RemoteComputerName -ScriptBlock {

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\' -Name fDenyTSConnections

}

If fDenyTSConnections is set to 0, it means that RDP connections are allowed. If it is set to 1, RDP connections are disabled.

51 of 65

Verify the Windows Firewall Configuration for RDP

Invoke-Command -ComputerName RemoteComputerName -ScriptBlock {

Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)"

}

Make sure the firewall rule is enabled (Enabled should be True), and the action is set to Allow.

53 of 65

Check the Listening State of RDP Port

To verify that the RDP port (TCP 3389) is listening, use the following command:powershellCopy code

Invoke-Command -ComputerName RemoteComputerName -ScriptBlock { Test-NetConnection -ComputerName localhost -Port 3389}

This command checks if the RDP port is listening on the remote computer.

55 of 65

Inbound Firewall rules

56 of 65

TermService

TermService (Remote Desktop Services): This service allows users to connect to the machine via RDP. It must be running on both the client and server.

PowerShell Check: Get-Service -Name TermService
Command-Line Check: sc query TermService
Troubleshooting: If not running, start the service using Start-Service -Name TermService or net start TermService.
Check for errors in Event Viewer under "Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager".

58 of 65

Critical components

Rdpclip.exe (Remote Desktop Clipboard): Manages clipboard redirection between the client and the remote session.

Verification: Check the process in Task Manager or use tasklist | findstr rdpclip.exe.
Troubleshooting: If clipboard redirection fails, restart rdpclip.exe by killing the process and relaunching it from the command line: taskkill /im rdpclip.exe /f & start rdpclip.exe.

59 of 65

Group Policy Settings

Group Policy Object (GPO) Settings: Specific policies like "Allow users to connect remotely using Remote Desktop Services" can be configured to enable or disable RDC.

Verification:

PowerShell: Get-GPResultantSetOfPolicy -Computer <ComputerName> -ReportType HTML -Path C:\gporeport.html (Open the HTML file in a browser to view applied policies).
Command Line: gpresult /h C:\gporeport.html

60 of 65

mstsc.exe

mstsc.exe (Microsoft Terminal Services Client): The main executable that handles Remote Desktop connections.

Verification: Open Task Manager (Ctrl+Shift+Esc) and look for mstsc.exe.
Command-Line Check: tasklist | findstr mstsc.exe

61 of 65

Certificates and Encryption

TLS/SSL Certificates: Used to secure RDP sessions. Issues with certificates (like expired or self-signed certificates) can prevent connections.

Verification: Check certificates in "Certificate Manager" (certmgr.msc) under "Remote Desktop" folder.

PowerShell Check: Use Get-ChildItem -Path Cert:\LocalMachine\Remote Desktop to view and manage certificates.

62 of 65

Please consider becoming a channel member

you get an early viewing of all our video content
access to the complete series of videos for each subject
links to video notes and PowerPoint slide deck both in MS-Word and PDF format
Our eBook and resources folder
Join our channel membership, it’s $2.99/month); see the “Join” button on our channel homepage. https://www.youtube.com/channel/UCCAXBGYIJnScl0IFKXOIlsQ/join

64 of 65

We have subtitles for in many languages:

We translate subtitles on our videos into the many languages: عربى, българскиB, 简体中文）, 中國傳統的）, Nederlands, Suomalainen, Pilipino, français, Deutsche, हिंदी , Magyar, bahasa Indonesia, 日本語, 한국어, norsk, Polskie, português, Română, русский, Española, Kiswahili, Svenska, and Tiếng Việt

65 of 65

�A BIG THANK YOU TO ALL OF OUR MEMBERS, VIEWERS AND SUBSCRIBERS!�

1 of 65

2 of 65

3 of 65

4 of 65

5 of 65

6 of 65

7 of 65

8 of 65

9 of 65

10 of 65

11 of 65

12 of 65

13 of 65

14 of 65

15 of 65

16 of 65

17 of 65

18 of 65

19 of 65

20 of 65

21 of 65

22 of 65

23 of 65

24 of 65

25 of 65

26 of 65

27 of 65

28 of 65

29 of 65

30 of 65

31 of 65

32 of 65

33 of 65

34 of 65

35 of 65

36 of 65

37 of 65

38 of 65

39 of 65

40 of 65

41 of 65

42 of 65

43 of 65

44 of 65

45 of 65

46 of 65

47 of 65

48 of 65

49 of 65

50 of 65

51 of 65

52 of 65

53 of 65

54 of 65

55 of 65

56 of 65

57 of 65

58 of 65

59 of 65

60 of 65

61 of 65

62 of 65

63 of 65

64 of 65

65 of 65