windows 2008 r2 remote desktop service

[ricki]

HI

 

Please can some one help. We have just had another windows update and its killed the remote desktop service on one of our windows 2008 r2 servers. We had this before due to an update and this fix repaired it last time

 

Windows Update KB2667402 cuasing problem. Please see MS12-020: Description of the security update for Terminal Server Denial of Service Vulnerability: March 13, 2012 for more details.

 

1) Connect remotely to affected server using the Computer Management Console

 

2) Stop the Remote Desktop Services

 

3) Take Ownership of file C:\Windows\System32\rdpcorekmts.dll and assign full NTFS permissions to your account

 

4) Rename file to rdpcorekmts.old

 

5) Copy file rdpcorekmts.dll from a non-patched server. I used another one of our domain controllers just to be safe.

 

6) Start the Remote Desktop Services

 

7) Test RDP login to server

 

I have remove the KB2667402 and that did not fix it.

 

I have installed the KB2667402 v2 from windows update and rebooted the server and that did not fix it.

 

I have done a sfc /scannow and that did not fix it.

 

I have followed the instructions from the first time and that did not fix it.

 

I am getting the following error

eventid 1000

Faulting application name: svchost.exe_TermService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1

Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66

Exception code: 0xc0000005

Fault offset: 0x000000000000a793

Faulting process id: 0x1024

Faulting application start time: 0x01cd4ee17450c96b

Faulting application path: C:\Windows\System32\svchost.exe

Faulting module path: C:\Windows\system32\rdpcorekmts.dll

Report Id: 622c68d9-badc-11e1-80b4-f4ce46b6323f

 

Has anyone seen this and does anyone have a fix

 

Thanks for all your help.

 

Richard

[Roger_vfcss]

dont you just love MS Windows updates!! NOT lol

[Voodoo]

We seem to be having similar problem. Only just started looking into it, but if anyone else has thoughts/experience of it, would be obliged for any info.

 

 

EDIT:

Seems to be quite an interesting thread about it here, with two different approaches being taken to try and solve it by different folks.

http://social.technet.microsoft.com/Forums/en-AU/winservergen/thread/f5855b60-f29c-4c90-b364-e364589e5267

Edited August 2, 2012 by Voodoo
found more info

[ricki]

Hi

 

I have just had a call back from microsft and they want to remote in but I am on holiday till September.

 

Richard

[Michael]

The problem does appear to be related to the rdpcorekmts.dll and whether or not you have 2008 R2 with SP1 installed.

 

All my 2008 R2 servers were built with an SP1 integrated ISO and I've not seen this issue at all. Is your server still built on 2008 R2 Gold or did you manually install SP1 at some point?