Every Windows Server (incl 10) has rdp-tcp listener with ID 65536.
What happens if we reach and exceed this ID?
I tested it on two different servers.
So, after exceeding what we have:
- After starting RDP Client it offers to enter credentials (as always).
But after entering its remote window opens with empty fileds: User and Password.
And need to reenter credentials one more time. - Also, if I have rdp file with saved credentials it doesn't work.
After starting it remote window opens with empty fileds: User and Password too.
When entering fixed event:
Log Name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
Source: Microsoft-Windows-TerminalServices-LocalSessionManager
Event ID: 21
Level: Information
User: SYSTEM
Computer: server
Description:
Remote Desktop Services: Session logon succeeded:
User: Admin
Session ID: 65557
This new session not displayed in:
- Task Manager
- Remote Desktop Services Manager
- query user
- query session
The only utility TSSessions.exe displaying it:
Session ID : 65557
Window Station Name : RDP-Tcp#5
State : Active
The specified session cannot be found. (Error # 7022 = 0x00001b6e)
The only way to reset the counter is restart server (.