Windows/Enable Remote Desktop remotely
What to do when remote desktop is not enabled on a Windows XP host and the machine is not in close enough proximity to warrant walking over to enable it. Do it remotely with psexec.
Prerequisites
- psexec from the Sysinternals
- A windows XP host with a network connection
Howto
Remote login
First we need to get a connection to the host in question with the psexec tool. And then check if the Terminal Server service is already running.
psexec \\<IPorHostName> -u Administrator cmd
should produce something along the lines
PsExec v1.98 - Execute processes remotely Copyright (C) 2001-2010 Mark Russinovich Sysinternals - www.sysinternals.com Password: Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\WINDOWS\system32>
Once on the remote host sc can tell if the services is enabled or not.
sc query termservice
Generally the service is running as we can see from the below output. SERVICE_NAME: termservice
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
However the service is not listening yet configured to listen on the default port of 3389.
netstat -an | findstr LISTEN
Shows all kind of other ports being open but not 3389
TCP 0.0.0.0:135 0.0.0.0:0 LISTEN TCP 0.0.0.0:445 0.0.0.0:0 LISTEN TCP 127.0.0.1:1033 0.0.0.0:0 LISTEN TCP 127.0.0.1:5152 0.0.0.0:0 LISTEN TCP 127.0.0.1:5354 0.0.0.0:0 LISTEN TCP 127.0.0.1:11880 0.0.0.0:0 LISTEN
Enable Remote Destkop with the registry
To enable the Remote Desktop service completly two registry entries have to be touched.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v TSEnabled /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
On Windows XP the second registry command will automatically tell the TermService service to start listening on port 3389. To check netstat has to be run once more.
netstat -an | findstr 3389
Should yield the following.
TCP 0.0.0.0:3389 0.0.0.0:0 LISTEN
Restrict access to certain users
It is probably a good idea to ensure that not everyone can login over Remote Desktop but only people that are part of the Administrator guild. While it is possible now to do this change over the newly enable Remote Desktop connection RealAdmins(tm) do it on the command line as well.
net localgroup "Remote Desktop Users" <UserName> /add
And to confirm
net localgroup "Remote Desktop Users"
should then show the below
Alias name Remote Desktop Users Comment Members in this group are granted the right to logon remotely Members ------------------------------------------------------------------------------- <Admin01> <Admin02> The command completed successfully.