Fix for 10.0.17134.706 and 10.0.17134.437

[skakyn34]

For 10.0.17134.437 you need:

1. Run Notepad as an administrator > open ini file C:\Program Files\RDP Wrapper\rdpwrap.ini
   and paste text:

[10.0.17763.437-SLInit]
bInitialized.x86 =CD798
bServerSku.x86 =CD79C
lMaxUserSessions.x86 =CD7A0
bAppServerAllowed.x86 =CD7A8
bRemoteConnAllowed.x86=CD7AC
bMultimonAllowed.x86 =CD7B0
ulMaxDebugSessions.x86=CD7B4
bFUSEnabled.x86 =CD7B8
bInitialized.x64 =ECAB0
bServerSku.x64 =ECAB4
lMaxUserSessions.x64 =ECAB8
bAppServerAllowed.x64 =ECAC0
bRemoteConnAllowed.x64=ECAC4
bMultimonAllowed.x64 =ECAC8
ulMaxDebugSessions.x64=ECACC
bFUSEnabled.x64 =ECAD0

[10.0.17763.437]
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=77A41
LocalOnlyCode.x64=jmpshort
SingleUserPatch.x64=1
SingleUserOffset.x64=3E520
SingleUserCode.x64=Zero
DefPolicyPatch.x64=1
DefPolicyOffset.x64=18025
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
SLInitHook.x64=1
SLInitOffset.x64=1ACDC
SLInitFunc.x64=New_CSLQuery_Initialize

There must be an empty line at the end!
2. uninstall update kb4493509.
Open CMD and run command:
wusa /uninstall /kb:4493509
and reboot.
3. For disable updates I'm use utility
https://www.sordum.org/9470/windows-update-blocker-v1-1/
If your system is automatically updated you will lose access again.

For 10.0.17134.706 you need:

1. Run Notepad as an administrator > open ini file C:\Program Files\RDP Wrapper\rdpwrap.ini
   and paste text:

[10.0.17134.706-SLInit]
bServerSku.x64 =F1378
lMaxUserSessions.x64 =F137C
bAppServerAllowed.x64 =F1380
bInitialized.x64 =F2430
bRemoteConnAllowed.x64=F2434
bMultimonAllowed.x64 =F2438
ulMaxDebugSessions.x64=F243C
bFUSEnabled.x64 =F2440

[10.0.17134.706]
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=92521
LocalOnlyCode.x64=jmpshort
SingleUserPatch.x64=1
SingleUserOffset.x64=1511C
SingleUserCode.x64=Zero
DefPolicyPatch.x64=1
DefPolicyOffset.x64=10E78
DefPolicyCode.x64=CDefPolicy_Query_edi_rcx
SLInitHook.x64=1
SLInitOffset.x64=22F5C
SLInitFunc.x64=New_CSLQuery_Initialize

There must be an empty line at the end!
2. uninstall update kb4493464.
Open CMD and run command:
wusa /uninstall /kb:4493464
and reboot.
3. For disable updates I'm use utility
https://www.sordum.org/9470/windows-update-blocker-v1-1/
If your system is automatically updated you will lose access again.

Many thanks to the developers for your work!
Огромное спасибо разработчикам за ваш труд!

[jaggeri]

Thanks!!

Tested - fully functional for Windows 10 Version 1803 (OS Build 17134.706) with termsrv.dll 10.0.17134.706 after a reboot.

But I did not have to uninstall KB449344 yet to get it working. Will continue testing this aspect in case of a delayed trojan.

I have disabled Windows Update in Computer Management Services, to avoid more sneaky gollum updates.

From now on only manual Win 10 updates on a test system first!!

[RoosterIllusion]

First time using the guide, but I got a different value for SingleUserOffset. That one was the most changed from the guide, so I took a guess.

This works for me without messing with windows updates. I don't see anything negative in the event logs.

[10.0.17763.437]
; Patch CEnforcementCore::GetInstanceOfTSLicense
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=77A41
LocalOnlyCode.x64=jmpshort
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
SingleUserPatch.x64=1
SingleUserOffset.x64=133B7
SingleUserCode.x64=Zero
; Patch CDefPolicy::Query
DefPolicyPatch.x64=1
DefPolicyOffset.x64=18025
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
; Hook CSLQuery::Initialize
SLInitHook.x64=1
SLInitOffset.x64=1ACDC
SLInitFunc.x64=New_CSLQuery_Initialize

[gpt-gmbh]

YOU ARE THE BEST!!!! THX A LOT

[dutchman1971]

With the new ini updates available, is it still necessary to uninstall kb4493509 and keep it from installing?

[ZeljkoManjkas]

Do you have parametars for x86?

[jiayaoO3O]

When my system is 10.0.17763.292, I can use the Single session per user function, but when my system is 10.0.17763.437,I use your settings, I can't use the Single session per user function, so is there a Some locations are still not set correctly?Here is my 10.0.17763.292 setup information:
[10.0.17763.292]
; Patch CEnforcementCore::GetInstanceOfTSLicense
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=AFAD4
LocalOnlyCode.x86=jmpshort
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=77A11
LocalOnlyCode.x64=jmpshort
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
SingleUserPatch.x86=1
SingleUserOffset.x86=4D665
SingleUserCode.x86=nop
SingleUserPatch.x64=1
SingleUserOffset.x64=1322C
SingleUserCode.x64=Zero
; Patch CDefPolicy::Query
DefPolicyPatch.x86=1
DefPolicyOffset.x86=4BE69
DefPolicyCode.x86=CDefPolicy_Query_eax_ecx
DefPolicyPatch.x64=1
DefPolicyOffset.x64=17F45
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
; Hook CSLQuery::Initialize
SLInitHook.x86=1
SLInitOffset.x86=5B18A
SLInitFunc.x86=New_CSLQuery_Initialize
SLInitHook.x64=1
SLInitOffset.x64=1ABFC
SLInitFunc.x64=New_CSLQuery_Initialize
;.---------------------------
[10.0.17763.292-SLInit]
bInitialized.x86 =CD798
bServerSku.x86 =CD79C
lMaxUserSessions.x86 =CD7A0
bAppServerAllowed.x86 =CD7A8
bRemoteConnAllowed.x86=CD7AC
bMultimonAllowed.x86 =CD7B0
ulMaxDebugSessions.x86=CD7B4
bFUSEnabled.x86 =CD7B8

bInitialized.x64 =ECAB0
bServerSku.x64 =ECAB4
lMaxUserSessions.x64 =ECAB8
bAppServerAllowed.x64 =ECAC0
bRemoteConnAllowed.x64=ECAC4
bMultimonAllowed.x64 =ECAC8
ulMaxDebugSessions.x64=ECACC
bFUSEnabled.x64 =ECAD0
;.---------------------------

[jiayaoO3O]

what the hell ? I suddenly found this feature Single session per user available again, thanks : )

[dsvolkov]

Just changing ini file solves the issue for me (without uninstalling patch). For 10.0.17134.706

[Kbotz]

dsvolkov: "Just changing ini file solves the issue for me (without uninstalling patch). For 10.0.17134.706"

Same here. No cumulative patch uninstall needed for 10.0.17134.706 on my W10 Home x64 laptop.

[joebeem]

Thanks. This worked for me without needing to uninstall updates on 10.0.17134.437

[sailendra00]

please help me i cant solve this problem

[culturevo]

Thanks for helping with my remote desktop problem. By the way, when a remote connection is terminated, automatic logoff is done. What should I do?

[MateuszZelent]

Hi, It works for me:
[10.0.17134.706]
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=ADAB8
LocalOnlyCode.x86=jmpshort
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=92521
LocalOnlyCode.x64=jmpshort
SingleUserPatch.x86=1
SingleUserOffset.x86=36B1C
SingleUserCode.x86=nop
SingleUserPatch.x64=1
SingleUserOffset.x64=1511C
SingleUserCode.x64=Zero
DefPolicyPatch.x86=1
DefPolicyOffset.x86=33579
DefPolicyCode.x86=CDefPolicy_Query_eax_ecx
DefPolicyPatch.x64=1
DefPolicyOffset.x64=10E78
DefPolicyCode.x64=CDefPolicy_Query_edi_rcx
SLInitHook.x86=1
SLInitOffset.x86=475DD
SLInitFunc.x86=New_CSLQuery_Initialize
SLInitHook.x64=1
SLInitOffset.x64=22F5C
SLInitFunc.x64=New_CSLQuery_Initialize

[10.0.17134.706-SLInit]
bServerSku.x64 =F1378
lMaxUserSessions.x64 =F137C
bAppServerAllowed.x64 =F1380
bInitialized.x64 =F2430
bRemoteConnAllowed.x64=F2434
bMultimonAllowed.x64 =F2438
ulMaxDebugSessions.x64=F243C
bFUSEnabled.x64 =F2440