Patch Windows 2008 Terminal Server to allow more than 2 concurrent sessions

Well it took some time but I patched Terminal Server for Windows 2008 to allow unlimited sessions in Remote Administration mode.

This patch is for 32 bit English version. In order to install it you need to perform the steps below. Before you start please check if using this patch is allowed according to your country’s law and your license agreement.

  • Install v-patch
  • From the vpatch directory launch vpatchprompt.exe
  • vpatchprompt will ask you for the following files:
    – Patch file (the .pat file).
    – Source file (termsrv.dll).
    – Destination file (the patched termsrv.dll).
  • Stop the “Terminal Services” service.
  • Take ownership of c:\windows\system32\Termsrv.dll
  • Give Administators full control of this file and rename it to Termsrv.dll.old
  • Place the patched file in the system32 folder
  • Restart “Terminal Services” service

EDIT: The download has been replaced with a new file containing the proper md5 hashes (see noone’s comments)

VPatch file: Windows Server 2008 VPatch file (18826) (of termsrv.dll build 6.0.6001.18000 English language)

See also:

Upcoming:

  • Terminal Server Patch for Windows XP X64

Leave a Reply

  1. Thanks for the digging but it didn’t work for this version so below is the diff.

    d605031e225aaccbceb5b76a4f1603a6 *termsrv.dll
    Version 6.0.6001.18000 English

    fc.exe /b in out:

    00018AD1: 8B 33 mov edi, eax -> xor edi, edi
    00018AD2: F8 FF

    0001AEC0: 8B 33 mov edi, eax -> xor edi, edi
    0001AEC1: F8 FF

    0001B29F: 0F 90 jg 6e82703d -> nops
    0001B2A0: 8F 90
    0001B2A1: 98 90
    0001B2A2: B1 90
    0001B2A3: 00 90
    0001B2A4: 00 90

  2. @noone: please check this registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server, value UserSessionLimit. What is it’s value?

    Also check if you have a MaxInstanceCount value.

  3. I wasn’t clear enough maybe. The patch didn’t _apply_ without modifying VPatch. Please check the md5 for your termsrv.dll and if it’s the same with mine retry the patch you provided. I’ve used the last VPatch from the site.

    I haven’t tested this patch to see if it will work properly but I’ll trust you until I’ll get to the 2008 machine to see for my self. I was just giving back some info :).

  4. strange, the MD5 hashes of my files are the same as in the vpatch file. However I checked the original file in my vista installation (which should be the exactly the same as in 2008 because they share the kernel) and this gives exactly your md5.
    I had several patch attempts before I had everything working so maybe I saved a patched version as the original…
    It doesn’t matter for the result though because the version with the final patch was based on the original. I have tested it on 3 different 2008 servers and also with various actions (connect, reconnect, disconnect etc.) and it’s working fine there.
    I’ll see if I can do a clean re-install and get the original file from there. For now I assume your file/hash it the correct one (I will upload a new vpatch file).

  5. @noone: I verified with a new installation and the termsrv dll from that installation has the same md5 hash as yours and the dll from my vista installation.
    I recreated and uploaded the vpatch file.

  6. Pingback: Secure Citrix Systems » Blog Archive » Patch Windows 2008 Terminal Server to allow more than 2 concurrent …

  7. Nice work Remko!

    I tried this one on a Swedish Enterprise version that I am using as my own personal playground, and it worked like a charm.

    Though, it took me a couple of minutes to realize that I had to uninstall the Terminal Server Role for this to work.

    Great work, thank you very much.
    //Mats

  8. >Upcoming:
    >Terminal Server Patch for Windows XP X64

    Oh! We are still hoping that you will finish it soonest, Remko! Could you please inform us how it is going now? Thank you.

  9. Pasha, don’t worry, Windows 2003 X64 and Windows XP 64 patches will follow.
    BTW I suspect that hitting the Paypal donation button might put it up higher in the priority list 😉

  10. Hello Remko, excelent blog you have here 😉

    I want to ask you how to debug the termsrv.dll? i mean the Terminal Server service? can you explain to us how to “see” what the dll is doing? i know how to doit with a .exe and with a .dll with an specific entry point 😉

    Greetings.

  11. Hi Tr4d3r,

    If you want to debug termsrv.dll, you just need to have the debugger which can attach to the running process :-). Open termsrv.dll in your debugger, and click on “attach to process”. Usually it will be one named svchost.exe. Be careful with it, as it’s a system critical service, and if you terminate it, you’d have to reboot your system.

  12. Thaks for your great work.

    waiting a fantastic 2008×64 version.

    byee.

  13. Can somebody gives to me the diferences from the original file and the pathched file of termsvr.dll for windows 2008 Server? just like
    fc /b original.dll patched.dll
    Thanks

  14. I have change the registry value to 0 for registry key “fSingleSessionPerUser”

    My Termserv.dll version is 6.0.6001.18000 English
    Working Great. Thanks a lot Remko.

  15. hello i’ve made this for server 2008 r2, it is based on remko’s work. It is not 100% tested
    Comparing files termsrv.dll y TERMSRV.PATCHED.DLL
    000100AF: 0F 90
    000100B0: 8F 90
    000100B1: 62 90
    000100B2: 3D 90
    000100B3: 01 90
    000100B4: 00 90
    0001474C: 8B 33
    0001474D: D8 C0
    00014A59: 0F 90
    00014A5A: 8F 90
    00014A5B: 94 90
    00014A5C: F4 90
    00014A5D: 00 90
    00014A5E: 00 90
    00018506: 8B 33
    00018507: D8 DB
    00018508: 85 90
    00018509: C0 90
    0001850A: 0F 90
    0001850B: 88 90
    0001850C: C4 90
    0001850D: 7C 90
    0001850E: 00 90
    0001850F: 00 90

  16. I second the motion. 2008 and 2008 R2 64 bit version would be really great!

    Any chance it will happen soon?

  17. Hi Renco
    Fantastic job, when you can do it for w2008 x64 and w2008 r2 ?

  18. Windows 2008 R2 please.

    The deepxw link doesn’t allow multiple same user sessions. (It allows multiple users beyond 2, but never same user even if fSingleSessionPerUser=0 and fSingleSessionPerUser is policied out.

  19. Is there a patch for a SBS2003 SP2 server?

    Termsrv.dll version 5.2.3790.3959

  20. i want ask when i disable terminal service my administrator account which on rdp will get disconnected ?

  21. Pingback: Dear Visitor | Remko Weijnen's Blog (Remko's Blog)

  22. i need a help plzzzzzzz

    my Current Version is 6.1.7601.17514 Windows Server 2008 R2 x64 …

    i tried all kind of patches but nothing works.

    Even UniversalTermsrvPatch_20090425 … it says patched but doens’t work !!!

    if u there is a way please let me know .. wot is the right steps to unlock sessions for more than 2 connections.

    plz plz plz Help !!!

  23. special tanks for you remko
    i need a solution for remote app in server 2008 r2
    to dosnt expire after 120 days

  24. Am I right in concidering, that in order to use this very helpful patch in Server 08 SP1 (x86) it is provided that:
    1. Terminal Server Role is Enabled;
    2. Service Pack 2 is not installed;

    If so, should I enable some other roles on the server 08 too ?

  25. When i browse for Source file (termsrv.dll) i did see on the directory. But when i went to go through on Explorer i can get them.

    Any one can help to get rid of the problem.

  26. Hi Remko !
    I have been very happy in reading this article, but checked now my version of termsrv.dll: 6.0.6002.18005.
    The system is English version. I tried vPatch on it with the file provided here, but it ends with: “The patch data is invalid or corrupt” message. Can you give a hand, please ?

  27. Hi again,
    I suspected version number (as the installation was with SP2) for the trouble. So I found another evaluation WS08 SP1 x86 copy (3 days to activate) with termsrv.dll version: 6.0.6001.18000, English. I installed it in a Virtual Machine. I repeated the process. It came up with the same error message. I repeated the process while copying the source and patch files on another machine (XP). Same message.
    Here you are my .dll: h–p://hotfile.com/dl/126634822/7f6b4cc/WS08x86.6001.18000.dll.rar.html

  28. Hello Remco,

    I am trying to follow your instructions to patch my Server 2008 for more remote sessions but obviously I have missed something important. Could you help please with more detailed instructions on this topic.

    Greetings,

    Sean

  29. i am having same problem with version of termsrv.dll: 6.0.6002.18005 , any help

    regards,

    kamran

  30. I have applied the patch successfully on server 2008 86x but now i am getting blue screen and restarts on its own although i used a fresh installation !!! any help ?

    Regards

  31. If it bsod’s even after fresh installation then the ts patch cannot be the cause.
    Did you lookup the stopcode? Copy the memory dump and use windbg with !analyze -v this often correctly identifies the root cause.