Remote Desktop Protocol Archives

Winsage

March 28, 2025

Microsoft fixes Remote Desktop issues caused by Windows updates

Microsoft has addressed an issue affecting Remote Desktop Protocol (RDP) and Remote Desktop Services (RDS) connections for users connecting from Windows 11 24H2 to RDS hosts on earlier versions of Windows Server 2016, which arose after installing Windows updates since January 2025. Users reported disconnections after 65 seconds when establishing UDP connections. Affected users were advised to install the KB5053656 preview update to resolve the issue, which will be generally available with next month's cumulative updates. Additionally, Microsoft is working on fixing another issue causing Remote Desktop freezes on Windows Server 2025 and is investigating connection errors related to data restoration on Windows 11 24H2 systems. A bug causing USB printers to print random text has also been resolved.

Winsage

March 27, 2025

Remote desktop problems? Guess what? It’s probably because of another flaky update for Windows

Microsoft is using its Known Issue Rollback (KIR) strategy to address unexpected disconnections in Remote Desktop sessions linked to the January 2025 Windows preview update and exacerbated by the March 2025 Windows security update. Users may experience RDP sessions disconnecting after 65 seconds when establishing UDP-based connections from Windows 11, version 24H2 devices to RDS deployments on Windows Server 2016 or earlier. While KIR will assist Home and Pro users, system administrators may need to adjust Group Policy to effectively mitigate the issue.

Winsage

March 27, 2025

Optional Windows 11 update fixes USB printers spitting out nonsense

Microsoft released the KB5053657 update on Tuesday to address an issue in Windows 11 where certain USB printers were printing random text. This update is applicable only to Windows 11 23H2 and 22H2 versions, while users of Windows 11 24H2 do not have an equivalent update yet. The USB printer issue originated from a problematic update released in January 2025, which affected multiple patches. Microsoft clarified that the update fixes issues with USB connected dual-mode printers that might output incorrect text. Additionally, complications from the January update for Windows 11 24H2 have caused Remote Desktop Protocol (RDP) disconnections. Microsoft is implementing a Known Issue Rollback to revert the problematic changes, with a permanent solution expected in a future update for Windows 11 24H2.

Winsage

March 27, 2025

Recent Windows Server 2025 updates cause Remote Desktop freezes

Microsoft has acknowledged a significant issue affecting Remote Desktop functionality on Windows Server 2025 systems, which arose after the installation of security updates released since February 2025. Users may experience freezes in Remote Desktop sessions shortly after connecting, with unresponsive mouse and keyboard inputs requiring a disconnect and reconnect to regain functionality. This issue also affects Windows 11 24H2 systems, but Microsoft addressed it for Windows 11 users with an optional update (KB5052093) released on February 25. A fix for Windows Server 2025 devices is planned for an upcoming update. Additionally, Microsoft has implemented Known Issue Rollback (KIR) to reverse problematic non-security updates related to Remote Desktop and Remote Desktop Services (RDS) connection issues from Windows 11 24H2 updates since January 2025. Users may experience Remote Desktop Protocol (RDP) disconnections lasting up to 65 seconds when connecting from Windows 11 24H2 devices to RDS hosts on Windows Server 2016 systems. A permanent fix for RDP disconnection issues is planned for next month's cumulative updates. Microsoft is also investigating connection errors on Windows 11 24H2 systems related to restoring data from SMB network shares or Backup & Replication servers.

Winsage

March 26, 2025

Microsoft: Recent Windows updates cause Remote Desktop issues

Microsoft has informed users about issues with Remote Desktop and Remote Desktop Services (RDS) connections after recent Windows updates since January 2025. Users may experience unexpected disconnections during Remote Desktop Protocol (RDP) sessions following the January preview update (KB5050094) and the March 2025 security update (KB5053598). Specifically, users connecting from Windows 11 24H2 PCs to RDS hosts on Windows Server 2016 or earlier may be disconnected after about 65 seconds. Microsoft has introduced a solution through its Known Issue Rollback (KIR) feature, requiring administrators to install and configure the Windows 11 24H2 and Windows Server 2025 KB5053598 250314_20401 KIR group policy. A restart of affected devices is necessary to apply the new settings. A permanent fix will be included in a future Windows update.

Winsage

March 24, 2025

New Browser-Based RDP for Secure Remote Windows Server Access

Cloudflare has launched a clientless, browser-based Remote Desktop Protocol (RDP) solution that enhances its Zero Trust Network Access (ZTNA) capabilities for secure access to Windows servers. This solution eliminates the need for traditional RDP clients and utilizes IronRDP, a high-performance RDP client developed in Rust, which operates within the browser. The implementation secures RDP sessions using TLS-based WebSocket connections and integrates with Cloudflare Access for authentication through JSON Web Tokens (JWT). The system supports modern security standards, including Single Sign-On (SSO), Multi-Factor Authentication (MFA), and device posture checks. Cloudflare plans to add session monitoring, data loss prevention features, and pursue FedRAMP High certification for compliance with government standards.

Tech Optimizer

March 21, 2025

Cybercriminals Exploit CheckPoint Driver Flaws in Malicious Campaign

A report by Nima Bagheri reveals that CheckPoint’s ZoneAlarm antivirus software is being exploited by threat actors using a method called Bring Your Own Vulnerable Driver (BYOVD). This attack targets vulnerabilities in the vsdatant.sys driver, which operates with high-level kernel privileges, allowing attackers to bypass Windows security measures. Specifically, version 14.1.32.0 of vsdatant.sys, released in 2016, contains vulnerabilities that enable attackers to circumvent the Windows Memory Integrity feature, gaining access to sensitive information and establishing persistent connections to compromised systems. Bagheri advises users to update to the latest version of vsdatant.sys, which is not vulnerable. CheckPoint confirmed that the outdated driver is no longer in use and that users running the latest versions of ZoneAlarm or Harmony Endpoint are not affected.

Tech Optimizer

March 20, 2025

Dangerous new password-stealing trojan automatically reinstalls itself on infected PCs

Microsoft Incident Response has identified a new remote access trojan (RAT) called StilachiRAT, which extracts sensitive information from infected computers, including passwords, cryptocurrency wallet details, operating system specifications, and device identifiers. StilachiRAT has a self-reinstatement mechanism that allows it to reinstall itself if removed. It targets digital wallets from platforms like Coinbase Wallet, Phantom, Trust Wallet, Metamask, OKX Wallet, and Bitget Wallet. The malware can harvest credentials from web browsers, monitor clipboard data, gather system information, detect camera presence, and track active Remote Desktop Protocol (RDP) sessions. It can extract credentials from Google Chrome, monitor clipboard activity, and maintain its presence using the Windows service control manager. StilachiRAT can impersonate users to monitor RDP sessions and employs anti-forensics mechanisms to evade detection. Discovered in November of the previous year, it has not yet achieved widespread distribution. Microsoft advises users to download software from official websites, use robust security software, install reputable antivirus, be vigilant against phishing attacks, avoid clicking on unexpected links, and consider using a VPN and password manager for enhanced security.

Winsage

March 18, 2025

Microsoft shoots itself in the foot: Windows update uninstalls Copilot

The March update for Windows 11 24H2 is causing issues by inadvertently removing the Copilot AI assistant from certain devices and the taskbar. This bug is associated with updates KB5053598, KB5053602, and KB5053606. Microsoft has acknowledged the issue and is working on a resolution. Users can manually reinstall the Copilot app via the Microsoft Store. The update has also led to other problems, including BSOD errors, crashing SSDs, and complications with Remote Desktop Protocol (RDP). Microsoft is investigating these additional issues.

Winsage

March 18, 2025

Microsoft Warns Windows Users—Change Your Browser As New Attacks Underway

Microsoft has issued a warning to Chrome users about a new remote access trojan called StilachiRAT, which can exfiltrate sensitive information such as stored credentials and digital wallet data. StilachiRAT can scan for configuration data across 20 cryptocurrency wallet extensions in Chrome and can extract and decrypt saved usernames and passwords. The malware can also monitor Remote Desktop Protocol (RDP) sessions, capture active window information, and impersonate users to gain unauthorized access to networks. Microsoft recommends that users switch to its Edge browser or other browsers with SmartScreen technology to enhance security. Additionally, users are advised to install software from official sources, utilize Safe Links and Safe Attachments in Office 365, and enable network protection features in Microsoft Defender for Endpoint. Despite this, Chrome remains the dominant browser among Windows users.