Windows server 2003 Backdoor

By default a Windows 2003 Server does only allow 2 simultaneous terminal server connections for remote management. "Log Off" closes the Session and releases the connection, but "Disconnecting" such as hitting the "X" to close the Remote Desktop Client leaves your session running and leaves your connection active, so that you can reconnect if your connection information hasn't changed. But what to do if your connection information has changed and you can't reconnect and the second connection is also not available?

There is one backdoor which can be used. Since Windows 2003 there is a little known feature which helps in a "too many connections" situation. The Remote Desktop client offers an option which allows you to connect to the console. This gives you a 3rd connection. If someone is logged into the console you have to have the sufficient permissions then the session will be logged out and you can log in. If nobody is logged into the console it will let you log in.

Start -> Run -> CMD
mstsc -v:x.x.x.x /console

x.x.x.x IP of server

You will be logged in to server as normal and if you want to disconnect the bad sessions simpley on end task click on user , select user you want to disconnect and click disconnect



Older versions of the client (i.e. windows 2000) seem to ignore the -v and pop up a connection window. Use the IP number, not the hostname, to start the connection. You will continue to get the too many services error if you use the hostname.