none
svchost.exe_TermService crashes after installation of KB2621440

    Question

  • We have installed KB2621440 on our W2k8R2 servers. Most of them work fine, but on the two Exchange servers, RDP does not work any more except for one of our admins. In case any other admin logs on, the RDP process on the server crashes. The problem is reproducible. So far we have not been able to figure out what the difference between the user that works and the rest of the accounts is. The error logged is the following:

    MachineName = Nocturne
    Data = { }
    Index = 2524526
    Category = Application Crashing Events
    CategoryNumber = 100
    EventID = 1000
    EntryType = Error
    Message = Faulting application name: svchost.exe_TermService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
    Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66
    Exception code: 0xc0000005
    Fault offset: 0x000000000000a793
    Faulting process id: 0x2290
    Faulting application start time: 0x01cd02bea9a45d95
    Faulting application path: C:\Windows\System32\svchost.exe
    Faulting module path: C:\Windows\system32\rdpcorekmts.dll
    Report Id: 20d32eb2-6eb2-11e1-b8f5-d8d385b2b4ac
    Source = Application Error
    ReplacementStrings = { svchost.exe_TermService, 6.1.7600.16385, 4a5bc3c1, rdpcorekmts.dll, 6.1.7600.16952, 4f1f9e66, c0000005, 000000000000a793, 2290, 01cd02bea9a45d95, C:\Windows\System32\svchost.exe, C:\Windows\system32\rdpcorekmts.dll, 20d32eb2-6eb2-11e1-b8f5-d8d385b2b4ac }
    InstanceId = 1000
    TimeGenerated = 15.03.2012 16:18:34
    TimeWritten = 15.03.2012 16:18:34
    UserName = 
    Site = 
    Container = 

    Any suggestions?

    Best regards,
    Christoph


    Thursday, March 15, 2012 3:26 PM

Answers

  • Check Known Issues on kb2667402 (http://support.microsoft.com/kb/2667402)

    Reinstall of update 2667402 fixed the issue for me.

    If you don't want to restart - just stop the rdp-service, install update 2667402 and start rdp-service.

    "After you install security update 2667402 on a computer that is running Windows 7 or Windows Server 2008 R2, and then you install Service Pack 1 (SP1) for Windows 7 or Windows Server 2008 R2, the binary version of Rdpcorekmts.dll is 6.1.7600.16952 and not 6.1.7601.17514. In this scenario, you may be unable to create a remote desktop session to control the Windows 7 or Windows Server 2008 R2-based computer.

    This issue occurs because the SP1 binary version of Rdpcorekmts.dll was not originally deployed when security update 2667402 was originally installed. 

    To work around this issue, visit Windows Update to reinstall security update 2667402. "

    Thursday, April 12, 2012 10:44 AM
  • Microsoft lists the file version as 6.1.7600.16952 but my non-patched system has a file version of 6.1.7601.17514 and now my system that experienced this problem has a file version of 6.1.7601.17767. I don't know if this means that my system is still vulnerable to exploit as part of the MS12-020 update or not, but RDP is functioning for me at this time and I can now wait and see if Microsoft has any updates on this.

    I have checked this and can confirm:

    The broken servers have 6.1.7600.16952 of rdpcorekmts.dll.

    The working servers have 6.1.7601.17767 of rdpcorekmts.dll.

    That is btw. independent of the edition, i. e. we also have a working Enterprise edition. As far as I can tell, we did nothing special to install the updates, i. e. it seems to be non-deterministic which version gets installed.

    Friday, March 16, 2012 8:33 AM

All replies

  • We also have the same symptoms.
    Thursday, March 15, 2012 4:12 PM
  • Same for us.  I tried rolling back the KB2621440 and the problem persists.  I can login to the console without a problem.  If I restart the Remote Desktop Services service I get one login and then it crashes.  Blahh....

    Brian Moscicki

    Thursday, March 15, 2012 5:04 PM
  • I have same problem on a W2k8R2 domain controller :-(

    Laci

    Thursday, March 15, 2012 5:45 PM
  • Having the same issue on 2 servers.

    Also tried to uninstall  KB2621440 , but that did nothing.

    Log Name:      Application
    Source:        Application Error
    Date:          3/15/2012 9:36:11 AM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     

    Description:
    Faulting application name: svchost.exe_TermService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
    Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66
    Exception code: 0xc0000005
    Fault offset: 0x000000000000a793
    Faulting process id: 0x5cc
    Faulting application start time: 0x01cd029074e92016
    Faulting application path: C:\Windows\System32\svchost.exe
    Faulting module path: C:\Windows\system32\rdpcorekmts.dll
    Report Id: f8d15aa9-6ebc-11e1-ad72-005056bc000e
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2012-03-15T16:36:11.000000000Z" />
        <EventRecordID>625</EventRecordID>
        <Channel>Application</Channel>
        <Computer>nyo-xa001p.gic.com.sg</Computer>
        <Security />
      </System>
      <EventData>
        <Data>svchost.exe_TermService</Data>
        <Data>6.1.7600.16385</Data>
        <Data>4a5bc3c1</Data>
        <Data>rdpcorekmts.dll</Data>
        <Data>6.1.7600.16952</Data>
        <Data>4f1f9e66</Data>
        <Data>c0000005</Data>
        <Data>000000000000a793</Data>
        <Data>5cc</Data>
        <Data>01cd029074e92016</Data>
        <Data>C:\Windows\System32\svchost.exe</Data>
        <Data>C:\Windows\system32\rdpcorekmts.dll</Data>
        <Data>f8d15aa9-6ebc-11e1-ad72-005056bc000e</Data>
      </EventData>
    </Event>

    Thursday, March 15, 2012 6:17 PM
  • Same issue...seems nothing I do fixes the issue.  Its almost like the service isn't listening.
    Thursday, March 15, 2012 7:13 PM
  • Let me add some details: We usually have our own patch day two weeks after the official one to avoid such problems of servers being broken. However, because of MS12-020, we decided to install the updates out of schedule.

    This means, we ran Windows Update as normal, i. e. we did not only install KB2621440, but all other updates that have been available this morning. I only mentioned KB2621440 in the title, because this is the update fixing the RDP security issue. However, I cannot rule out the possiblity that any other update offered today might have caused the problem.

    We are operating a bunch of Windows servers for several purposes, most importantly redundant DCs, the above mentioned mail servers and a file server. The problem so far only affects the mail servers. Both servers are hardware-identical and run the same software to form an Exchange 2010 DAG. Therefore, the Windows OS is an Enterprise edition. All other servers, which are still working as intended, are Standard editions.

    I also mentioned that exactly one of our admins still can logon remotely to the problematic servers. The account does not have different group memberships than other ones that are not working. As the machine in question is our mail server, only a few people have access. We have not yet checked all accounts, but so far it looks as only the beforementioned is still working. This is the account that did log on first after the update. The problem is also not dependent on the machine that the logon attempt is made from, but only on the account. The working account works from all machines, all other accounts work from no machine. This also includes the local Administrator account of the servers.

    As far as I see, the RDP service is listening (not as Rich stated), but is crashing on the first logon attempt other than the one account working. For a short period of time, I can see that the session is starting and desktop is prepared, but then the connection is lost and the event we all see is logged. I can restart the service using

    Invoke-Command -ComputerName ... -ScriptBlock { Start-Service TermService }
    but as soon as the next login attempt is made, the service crashes again.
    Thursday, March 15, 2012 7:59 PM
  • I have the same problem as the OP and I also found that kb article but it doesn't fix the problem.

    I found that kb2667402 was waiting to be installed, so I installed that and problem went away.

    Something to check after this is that seems that installing this update changed the Remote Desktop settings on the server to Network Level Authentication. So if you have XP clients, change back to the less secure option

    Friday, March 16, 2012 12:20 AM
  • Also were this problem. Solved with recheck System properties -> Remote from (less secure) to (more secure) and back. KB2667402 and 2621440 installed.
    • Proposed as answer by Michiel69 Wednesday, March 21, 2012 12:49 PM
    Friday, March 16, 2012 5:17 AM
  • Hi Christoph,  

       I also had the same problem after patching one of my domain controllers today. I've managed to solve the problem by replacing the DLL file C:\Windows\System32\rdpcorekmts.dll with one from a non-patched server. I'm not sure if you have access to the console of the affected server, but I did not due to my servers remote location in a secure facility. I will list my steps below which I had to perform remotely.

    Just a quick note the file is update by Windows Update KB2667402 not KB2621440. Please see http://support.microsoft.com/kb/2667402 for more details.

    1) Connect remotely to affected server using the Computer Management Console

    2) Stop the Remote Desktop Services

    3) Take Ownership of file C:\Windows\System32\rdpcorekmts.dll and assign full NTFS permissions to your account

    4) Rename file to rdpcorekmts.old

    5) Copy file rdpcorekmts.dll from a non-patched server. I used another one of our domain controllers just to be safe.

    6) Start the Remote Desktop Services

    7) Test RDP login to server

    I have since re-installed Windows Updates KB2667402 after removing the update and restating the server, and RDP functionality is still working correctly. I did notice one odd thing with the file versions between what Microsoft lists the file version as in the support article and a patched / non patched server. Microsoft lists the file version as 6.1.7600.16952 but my non-patched system has a file version of 6.1.7601.17514 and now my system that experienced this problem has a file version of 6.1.7601.17767. I don't know if this means that my system is still vulnerable to exploit as part of the MS12-020 update or not, but RDP is functioning for me at this time and I can now wait and see if Microsoft has any updates on this.

    I hope this information helps for you or anyone else that might come across this problem

    Regards,

    Travis

    Friday, March 16, 2012 6:00 AM
  • Hi all,

    thanks for the suggestions so far.

    C:\Windows\System32\rdpcorekmts.dll with one from a non-patched server. I'm not sure if you have access to the console of the affected server, but I did not due to my servers remote location in a secure facility. I will list my steps below which I had to perform remotely.

    Yes, we have access to the console via IPMI KVM. And we have made a very interesting discovery this morning: RDP work exactly for those users who have (at least once) logged on to the console after the update. It crashes for all others. We will try replacing the DLL next and see whether this solves the problem for all users.

    Best regards,
    Christoph


    Friday, March 16, 2012 8:13 AM
  • Microsoft lists the file version as 6.1.7600.16952 but my non-patched system has a file version of 6.1.7601.17514 and now my system that experienced this problem has a file version of 6.1.7601.17767. I don't know if this means that my system is still vulnerable to exploit as part of the MS12-020 update or not, but RDP is functioning for me at this time and I can now wait and see if Microsoft has any updates on this.

    I have checked this and can confirm:

    The broken servers have 6.1.7600.16952 of rdpcorekmts.dll.

    The working servers have 6.1.7601.17767 of rdpcorekmts.dll.

    That is btw. independent of the edition, i. e. we also have a working Enterprise edition. As far as I can tell, we did nothing special to install the updates, i. e. it seems to be non-deterministic which version gets installed.

    Friday, March 16, 2012 8:33 AM
  • I have checked this and can confirm:

    The broken servers have 6.1.7600.16952 of rdpcorekmts.dll.

    The working servers have 6.1.7601.17767 of rdpcorekmts.dll.

    We now copied version 6.1.7601.17767 from a successfully updated machine to the non-working one, which actually fixes the problem. So Travis is right, having 6.1.7600.16952 of rdpcorekmts.dll causes the problem.

    I think that in some cases, an update for Wk28R2 RTM (7600) gets installed on an SP1 machine (7601), could that be the case?

    Friday, March 16, 2012 8:51 AM
  • Just confirmation - have been following updates to this thread through the night - applied the steps as indicated by Travis - works!
    Friday, March 16, 2012 11:19 AM
  • To also add to file version problems.  Issues I brought up with my TAM are I have seen a very small handful of servers that think that SP1 is installed when in fact it's incomplete.  As a result, some patches flat out refuse to intall because the system is in a limbo state.  If I run through the SP1 installer again and reboot then patches then proceed to install.  Therefore, could it be that MS12-20 is installing the SP1 patch version on systems that indeed don't have SP1 installed? 

    Just a thought....

    Rich

    Friday, March 16, 2012 2:03 PM
  • Hi Christoph,  

       I also had the same problem after patching one of my domain controllers today. I've managed to solve the problem by replacing the DLL file C:\Windows\System32\rdpcorekmts.dll with one from a non-patched server. I'm not sure if you have access to the console of the affected server, but I did not due to my servers remote location in a secure facility. I will list my steps below which I had to perform remotely.

    Just a quick note the file is update by Windows Update KB2667402 not KB2621440. Please see http://support.microsoft.com/kb/2667402 for more details.

    1) Connect remotely to affected server using the Computer Management Console

    2) Stop the Remote Desktop Services

    3) Take Ownership of file C:\Windows\System32\rdpcorekmts.dll and assign full NTFS permissions to your account

    4) Rename file to rdpcorekmts.old

    5) Copy file rdpcorekmts.dll from a non-patched server. I used another one of our domain controllers just to be safe.

    6) Start the Remote Desktop Services

    7) Test RDP login to server

    I have since re-installed Windows Updates KB2667402 after removing the update and restating the server, and RDP functionality is still working correctly. I did notice one odd thing with the file versions between what Microsoft lists the file version as in the support article and a patched / non patched server. Microsoft lists the file version as 6.1.7600.16952 but my non-patched system has a file version of 6.1.7601.17514 and now my system that experienced this problem has a file version of 6.1.7601.17767. I don't know if this means that my system is still vulnerable to exploit as part of the MS12-020 update or not, but RDP is functioning for me at this time and I can now wait and see if Microsoft has any updates on this.

    I hope this information helps for you or anyone else that might come across this problem

    Regards,

    Travis

    Travis,

    I had the same problem..
    I think that the problem occurs when install KB2667402 and KB2621440 at the same time(In my case was this).... After i uninstall the both KBs and reinstalling first KB2621440 restart the machine, and after reinstall KB2667402, i didnt have the issue and RDP works normally... I dont need copy DLL file rdpcorekmts.dll manually.

    Thank for your comments...

    Regards,
    Tiago


    Tiago Santos


    Friday, March 16, 2012 6:47 PM
  • I think that the problem occurs when install KB2667402 and KB2621440 at the same time(In my case was this).... After i uninstall the both KBs and reinstalling first KB2621440 restart the machine, and after reinstall KB2621440, i didnt have the issue and RDP works normally... I dont need copy DLL file rdpcorekmts.dll manually.

    That is probably the better solution. I think changing the DLLs might cause sfc reporting errors at some time. However, the servers are production systems and I cannot reboot them all the time...

    I also think that Rich's suggestion with the SP1 is worth investigating.

    Friday, March 16, 2012 10:18 PM
  • I was seeing the same issue on two 2008R2 servers.

    6xCamaro's solution solved my issue.

    /kim

    Saturday, March 17, 2012 11:45 AM
  • Hello,

    Anybody seen problems on windows 2003 sp2. I am not able to rdp onto my server after applying KB2621440 as the only patch. This is the only one needed for this version of windows according to MS. This machine runs my vpn solution and the result after only patching it with this one patch is that vpn is not working in addition to rdp to the server is not working. I see no errors in the eventlogs that I can relate to this.

    Anyone?

    Monday, March 19, 2012 7:25 AM
  • Hello,

    Anybody seen problems on windows 2003 sp2. I am not able to rdp onto my server after applying KB2621440 as the only patch. This is the only one needed for this version of windows according to MS. This machine runs my vpn solution and the result after only patching it with this one patch is that vpn is not working in addition to rdp to the server is not working. I see no errors in the eventlogs that I can relate to this.

    Anyone?

    I am seeing this same issue. Thus far re-installing the KB2621440 does not appear to resolve the issue.
    Monday, March 19, 2012 6:55 PM
  • Hello,

    Anybody seen problems on windows 2003 sp2. I am not able to rdp onto my server after applying KB2621440 as the only patch. This is the only one needed for this version of windows according to MS. This machine runs my vpn solution and the result after only patching it with this one patch is that vpn is not working in addition to rdp to the server is not working. I see no errors in the eventlogs that I can relate to this.

    Anyone?

    I am seeing this same issue. Thus far re-installing the KB2621440 does not appear to resolve the issue.

    Try uninstalling KB2667402 instead. I think all who resolved the problem so far agree that this update is the cause, not KB2621440.

    Best regards,
    Christoph

    • Proposed as answer by bgreen-ims Tuesday, January 22, 2013 9:46 PM
    • Unproposed as answer by bgreen-ims Tuesday, January 22, 2013 9:46 PM
    Monday, March 19, 2012 7:50 PM
  • May have ran across a fix.... I installed RDP client 6.0 (http://support.microsoft.com/kb/925876), rebooted and that appears to have fixed the issue on my problematic 2003 systems. Need to perform this on a few more systems to verify.
    Monday, March 19, 2012 7:53 PM
  • It's very valuable. We met the issue tonight. Trying to fix it now. will update later
    Tuesday, March 20, 2012 6:58 AM
  • Another thing I noticed is that this appears to only be impacting systems that do not have terminal services installed.  I remedied the issue on 2003 R2 SP2 systems not running as a terminal server by installing the 6.0 client.

    Tuesday, March 20, 2012 3:46 PM
  • Hi all,

    We had the same problem here. I was about to try the other fix but couldn't find matching version DLL's.
    I decided to try this for the heck of it.
    Note: I restarted Remote Desktop Services just in case.
    Worked like a charm!

    Regards,

    Michiel

    Wednesday, March 21, 2012 12:52 PM
  • I had the same problem..
    I think that the problem occurs when install KB2667402 and KB2621440 at the same time(In my case was this).... After i uninstall the both KBs and reinstalling first KB2621440 restart the machine, and after reinstall KB2621440, i didnt have the issue and RDP works normally... I dont need copy DLL file rdpcorekmts.dll manually.

    Thank for your comments...

    Regards,
    Tiago


    Tiago Santos

    This solution works. Here is the link to the Russian-language TechNet Forum discussion on the same problem:

    http://social.technet.microsoft.com/Forums/ru-RU/ws2008r2ru/thread/47d42234-70bd-46a2-9dd5-185c53c2e82c

    Wednesday, March 21, 2012 7:11 PM
  • We had the same problem here. I was about to try the other fix but couldn't find matching version DLL's.
    I decided to try this for the heck of it.
    Note: I restarted Remote Desktop Services just in case.
    Worked like a charm!

    Hi Michiel,

    this might be only a temporary solution: the service might crash again if someone logs on, who has not logged on on the console before. You have probably restarted RDP services from the console, so it works for your account, but it could crash again for others. This is exactly what we observed, too (see my post of March 16, 2012 8:13 AM). In case you find the non-matching DLLs, I would recommend a re-installation anyway.

    Best regards,
    Christoph

    Wednesday, March 21, 2012 8:10 PM
  • I uninstalled KB2667402 and tried rdp again.  Rdp works fine now.
    Friday, March 23, 2012 8:18 AM
  • We had the same issue: RDP broke on win 2008 R2 server after patched these two KBs. Lucky, ilo was working. So after found this thread, we copied rdpcorekmts.dll from an un-patched server and replaced it. It resolved the issue.

    The above happened on Mar 19, 2012.

    so far, I was not sure which KB, KB2667402 or KB2621440, caused the issue since they were patched at the same time.

    In addition, this issue didn't happen on every server. Some win 2008 R2 patched a week before this issue happened are working fine, so far, without any issue yet.

    Here is the event log.

    Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66

    Exception code: 0xc0000005

    Fault offset: 0x000000000000a793

    Faulting process id: 0xe74

    Faulting application start time: 0x01cd066030fbd0c0

    Faulting application path: C:\Windows\System32\svchost.exe

    Faulting module path: C:\Windows\system32\rdpcorekmts.dll

    Report Id: 85029143-7253-11e1-b0f8-78e7d1e15dde

    Monday, March 26, 2012 6:08 PM
  • Has anyone called in a case to Microsoft on this?  Replacing DLLs with unpatched versions means that you aren't patched.
    Tuesday, March 27, 2012 5:32 PM
  • I'm pretty sure it is KB2621440 that caused it.  I ran Windows Update on my two servers that were experiencing the issue and KB2667402 was available.  After installing it and rebooting....I was able to login with RDP as normal.

    Steve Carnes


    • Edited by Ex2K7Steve Tuesday, March 27, 2012 11:39 PM
    Tuesday, March 27, 2012 11:38 PM
  • I have experienced the same exact problem on a brand new, freshly configured pair of Server 2008R2 SP1 boxes for HyperV (cluster). I made sure to fully patch everythig....  And yes, after pulling my hair out, and then reading this thread, removing KB2667402 fixed everything!  I'll bet Microsoft recalls this one and releases a "corrected patch", hopefully soon.

    Thursday, March 29, 2012 9:52 PM
  • Joshteck - did you have the other hotfix installed?  Or just applied KB2667402?  As I am not seeing others report this and unless people call in and Microsoft can repro this, nothing will get fixed.

    Please, call 1-800-Microsoft - state you have issues with KB2667402 and it will be a free call.

    But unless it's looked at, there's no bets here. 

    Thursday, March 29, 2012 11:55 PM
  • Hey All,

    We have encountered this issue as well and have escalated to PSS to investigate further. Their intial advice was inline with advice provided on this thread to reinstall KB2667402 which will overwrite the older rdpcorekmts.dll with the later version from the KB which worked for us. This appears to be due to if 2008 R2 SP1 is installed AFTER MS12-020 is installed the SP will just lay down an older version of the rdpcorekmts.dll overwriting the version installed by KB2667402. The word so far is that this SP1 install logic issue will be corrected in SP2... In our particular case a removal of the update, reboot and then let SCCM rescan and detect that the update is missing at which time it gets reinstalls fixing the issue.

    Cheers

    Ben

    Friday, March 30, 2012 7:28 AM
  • Hi all,

    We encountered the same issue as well. Checking the dll version tells me that we allso have the 6.1.7600.16952 version of tthe dll. The weird part is that when i check the installed updates it states that KB2667402 is installed succesfully. Though when i check for new updates the same KB2667402 update is available again. Obviously, installing this update by automatic updates failed. So i de-installed both updates KB2667402 and KB2621440, rebooted the server. After i installed both updates manually the issue seemed to be solved.
    Cheers

    Marco


    Regards, Marco Scholten


    • Edited by MMSch Friday, March 30, 2012 7:52 AM
    • Proposed as answer by M.E.van.der.Vlies Tuesday, April 10, 2012 8:16 AM
    Friday, March 30, 2012 7:51 AM
  • Unistalling the KB2667402 solve my problem ... im going to hide this bad boy ...

    Scott.

    Friday, March 30, 2012 11:42 AM
  • Siddus  do not hide this.  CALL into Microsoft.  Unless people call in, until they can repro the issue, it will not get fixed.

    Please, call!

    Friday, March 30, 2012 1:58 PM
  • I related this issue to our TAM. But at least in our case rebooting the problem systems is all it took.

    Edit:

    I was wrong, sort of. A reboot allowed us to RDP to the system, but only while it was completing the update to SP1, but after the system rebooted again we could no longer RDP.
    If anyone needs an easy way to fix here is a batch file I wrote up to fix our systems.
    You need to run this with a user that is an admin on the target system.
    Copy psexec and rdpcorekmts.dll (the new version) to a folder.
    Create a file named servernames.txt and add the name of the server(s) you want to fi
    Create a start.cmd file edit it and add the following:

    @echo off
    Echo *************************************************************
    echo * This process will update and change the file rdpcorekmts. *
    echo * If you don't want to do that, 'X' out now                 *
    echo *************************************************************
    pause

    :stop remote desktop services for /f %%i in (servernames.txt) do psexec \\%%i net stop "Remote Desktop Services" /y :Take Ownership for /f %%i in (servernames.txt) do psexec \\%%i takeown /F c:\windows\system32\rdpcorekmts.dll :Change permissions to full for /f %%i in (servernames.txt) do psexec \\%%i icacls c:\windows\system32\rdpcorekmts.dll /grant administrators:F :Copy in newer version for /f %%i in (servernames.txt) do copy rdpcorekmts.dll \\%%i\c$\windows\system32\ :Change permissions back to read-only for /f %%i in (servernames.txt) do psexec \\%%i icacls c:\windows\system32\rdpcorekmts.dll /grant administrators:R :start the service back up for /f %%i in (servernames.txt) do psexec \\%%i net start "Remote Desktop Services" /y Echo ******************************************************************** echo * Remove the names of the affected servers in the file Servernames * echo ******************************************************************** Echo *Should be all done now. * echo ************************** pause exit


    Double-click Start.cmd







    Friday, March 30, 2012 4:56 PM
  • To also add to file version problems.  Issues I brought up with my TAM are I have seen a very small handful of servers that think that SP1 is installed when in fact it's incomplete.  As a result, some patches flat out refuse to intall because the system is in a limbo state.  If I run through the SP1 installer again and reboot then patches then proceed to install.  Therefore, could it be that MS12-20 is installing the SP1 patch version on systems that indeed don't have SP1 installed? 

    Did anyone else experience such an SP1 installation problem before installing KB2667402? I recently talked to my colleague who installed SP1 on the two servers that failed. He told me that the installation of SP1 failed the first time and that he had to restart it. The server currently believes that it is SP1, but possibly Rich is right that something remained broken making Windows Update believe that the machine or the RDP part of the system is still RTM.

    Best regards,
    Christoph

    Friday, March 30, 2012 6:58 PM
  • I think Ben is bang on with this issue.

    I have a XenApp farm of 12 servers.  Before the March updates were released from Microsoft, I had successfully upgraded 5 of my XenApp servers running on 2008 R2 to SP1 successfully without issues.

    After the March updates were installed, when I performed the SP1 upgrade on the remaining 7 XenApp servers, they all had the same symptoms where terminal services was broken after SP1 installed and reboot.

    Servers that already had SP1 before the March updates are still working fine.

    If you have this issue, simply uninstall KB2667402, reboot the server and reinstall KB2667402.

    Sunday, April 01, 2012 11:47 PM
  • I've just had this issue with 2008R2. Patched via MS update site and RDP started crashing out. So I uninstalled KB 2667402 and all was happiness again!!

    Now there seems to be a problem re-installing it.

    Cheers

    simon

    Wednesday, April 04, 2012 3:07 PM
  • Hi

    I am having the same issue

    After Uninstalling the KB2667402 and KB2621440.

    I cound not get RDP connection at all. error the "remote computer could not found " and RDP service is still runiing

    Thanks

    Prakash

    Thursday, April 05, 2012 7:13 AM
  • What operating system?

    What are your rdping from and to?

    What's in the event log?

    And if you uninstalled the updates and you can't connect, it's probably not due to these updates.

    Thursday, April 05, 2012 7:26 AM
  • Hi Susan,

    OS is Windows 7 x64 with SP1

    there are not event log after uninstalling the updates.

    If i reinstall the update than i can connect to RDP but disconnect as soon i enter username\password.

    Thanks

    Prakash

    Thursday, April 05, 2012 9:26 AM
  • What are you connecting to?  Look in the event logs on the other side.
    Thursday, April 05, 2012 1:57 PM
  • Hi Susan,

    OS is Windows 7 x64 with SP1

    there are not event log after uninstalling the updates.

    If i reinstall the update than i can connect to RDP but disconnect as soon i enter username\password.

    Today, I tried the re-installation of KB2667402 on the server that I have not fixed by copying the correct version of the DLL and I can confirm this effect for an W2K8R2 SP1: WU always re-installs the wrong version of KB2667402, even if KB2621440 is not installed. Therefore, TermService crashes on an RDP connect (from any client OS). The error is exactly the same as before:

     <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <System>
      <Provider Name="Application Error" /> 
      <EventID Qualifiers="0">1000</EventID> 
      <Level>2</Level> 
      <Task>100</Task> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2012-04-05T15:56:32.000000000Z" /> 
      <EventRecordID>2534803</EventRecordID> 
      <Channel>Application</Channel> 
      <Computer>Nocturne....</Computer> 
      <Security /> 
      </System>
     <EventData>
      <Data>svchost.exe_TermService</Data> 
      <Data>6.1.7600.16385</Data> 
      <Data>4a5bc3c1</Data> 
      <Data>rdpcorekmts.dll</Data> 
      <Data>6.1.7600.16952</Data> 
      <Data>4f1f9e66</Data> 
      <Data>c0000005</Data> 
      <Data>000000000000a793</Data> 
      <Data>1270</Data> 
      <Data>01cd1344a2bed858</Data> 
      <Data>C:\Windows\System32\svchost.exe</Data> 
      <Data>C:\Windows\system32\rdpcorekmts.dll</Data> 
      <Data>e9b539c8-7f37-11e1-b0c2-d8d385b2b4ac</Data> 
      </EventData>
      </Event>

    Anyone who fixed the issue with a simple re-install instead of replacing DLLs: what is the exact order to do this?

    Thanks in advance,
    Christoph



    Thursday, April 05, 2012 3:59 PM
  • Hi Christoph,

    What did the trick for me was to de-install both KB2667402 and KB2621440 updates. After i rebooted the server i downloaded the updates by hand and manually installed both updates again. First the KB2621440 update and after that i installed KB2667402.

    I don't know if the manual installation is prefered in this siituation but it did the trick for me. Issue has been solved at my site ever since.
    I would say give it a try.

    Cheers. 


    Regards, Marco Scholten


    • Edited by MMSch Thursday, April 05, 2012 4:18 PM Added KB order
    • Proposed as answer by Sven_Burger Friday, April 06, 2012 1:16 PM
    Thursday, April 05, 2012 4:08 PM
  • I don't know if the manual installation is prefered in this siituation but it did the trick for me. Issue has been solved at my site ever since.
    I would say give it a try.

    Hi Marco,

    thanks for your answer. I did not yet try a manual install before. Provided that the packages from http://www.microsoft.com/download/en/details.aspx?id=29169 and http://www.microsoft.com/download/en/details.aspx?id=29116 are the right ones, it does not help (of course, I rebooted after uninstalling the updates). The effect is the same: After installation of KB2667402, rdpcodekmts.dll (which is newly added by KB2667402) has version 6.1.7600.16952. I think the problem is that the MSU package is for RTM and SP1, at least as I understand. Therefore, I cannot prevent it from choosing the wrong DLL.

    Any other ideas? I know that replacing the DLL manually works, but the server in question is important for us and I do not want to tinker around...

    Best regards,
    Christoph

    Thursday, April 05, 2012 6:24 PM
  • I'd honestly recommend calling 1-800-microsoft and stating you have an issue with MS12-020

    I'm not seeing this reported on the patchmanagement.org listserve so I'm not  sure if there's some reason you branch over to a different dll and thus this needs to be investigated as to the why and not the what.

    Thursday, April 05, 2012 6:30 PM
  • I'd honestly recommend calling 1-800-microsoft and stating you have an issue with MS12-020

    I'm not seeing this reported on the patchmanagement.org listserve so I'm not  sure if there's some reason you branch over to a different dll and thus this needs to be investigated as to the why and not the what.


    I think 1-800-microsoft is US-only, isn't it?
    Thursday, April 05, 2012 6:35 PM
  • http://support.microsoft.com/select/Default.aspx?target=assistance  see if selecting there by region will get you a phone number.
    Thursday, April 05, 2012 6:44 PM
  • Hi Christoph,

    I Agree with Susan. Your call should be at no cost as this issue appears after installation of the update.
    Keep us posted.

    Cheers


    Regards, Marco Scholten

    Thursday, April 05, 2012 7:18 PM
  • Opening support call now.  Will post with resolution.

    The answer is 42. What was the question?

    Thursday, April 05, 2012 9:39 PM
  • Support call is open, we are working on it.  Will be continuing tomorrow afternoon.


    The answer is 42. What was the question?

    Thursday, April 05, 2012 11:57 PM
  • Completed the support case with Microsoft today.  Below is the response.  I did follow the action plan as prescribed and it resolved the issue.

    Have a good weekend!

    Hello Rich,

     

    Please find the action plan for the unable to RDP issue we worked on today and let me know the status after following it,

     

    Uninstall KB2667402 and reboot the machine. Check RDP it should be working. You can reinstall KB2667402 and RDP will continue to work.

     

     

     

    This is a known issue with the hot fix KB2667402 which effects the file rdpcorekmts.dll.

     

    Regards,

     

    Murtuza Choonawala

    Support Engineer | Windows Server Performance Team |Microsoft Commercial Technical Support |

     

     

    International Phone numbers:

     

    United States/Canada: +1-425-704-3638 UK: 0808 2349667 Ireland: 1-800-760647 Australia: 1-800-151075 India: 1800 266 3050 New Zealand: 0800-451917 Singapore: 800-1205517 Malaysia: 1-800-815217 South Africa: 080-09-83720


    The answer is 42. What was the question?

    • Proposed as answer by Rich Perea Friday, April 06, 2012 9:38 PM
    Friday, April 06, 2012 9:38 PM
  • Hang on one sec.. http://support.microsoft.com/kb/2667402 is MS12-020.  He's saying that if you uninstall, reboot the machine and rdp will work.  Then you "can" reinstall it and it will continue to work.  He's saying this is a known issue. 

    Have I got the fact straight?

    Okay so where is this a known issue?

    http://support.microsoft.com/kb/2667402  All known issues with a security update should be documented on the underlying KB.  There is nothing documented there that I can see that talks the symptoms you guys are talking about?

    Can you get clarification from him while I kick this up the ladder on my side?

    Friday, April 06, 2012 9:57 PM
  • The specific steps we took were to disable all of the non-Microsoft services, reboot.

    Tested, RDP still not working.  (interesting side note:  if we RDP'd into the server as the same user that was logged onto the console, it did come up/take over the console session, but with a plain white screen with no icons or buttons.  any other user crashed the Remote Desktop Service.)

    Uninstalled KB2667402, rebooted and tested RDP successfully. 

    Downloaded KB2667402 directly (not Windows Update) and re-installed.

    Rebooted and tested RDP successfully.

    Re-enabled all non-Microsoft services, rebooted, and retested successfully.

    I did note that in the article there is nothing mentioned in the Known Issues section regarding the problem.  I have sent him and email asking him to comment on this thread.

    -Rich


    The answer is 42. What was the question?

    Monday, April 09, 2012 6:05 PM
  • I spoke with support again today and this was their reply:

    Hello Rich,

     

    To answer the question about the known issue.

    This issue has been reported to Microsoft and is under investigation. We still do not have sufficient data for it to be listed under the known issues section.

     

     

    Regards,

     

    Murtuza Choonawala |Support Engineer | MICROSOFT Broad Commercial | 1pm to 10pm PST | Monday to Friday | Extension: 2265302 |

     

     

    Chandresh Kanani (v-2chkan@mssupport.microsoft.com)| TECHNICAL LEAD | MICROSOFT Broad Commercial | 09:00AM – 06:00PM PST | Mon - Fri | Extension-2261004 |

     

    Rahul Goyal (v-2ragoy@mssupport.microsoft.com)  | Sr. TEAM MANAGER | MICROSOFT Broad Commercial | 5am to 2pm PST | Monday to Friday | Extension: 2255790 |

     

     

    Dial the number corresponding to your country followed by my extension:<2265302>

     

    |United States/Canada: +1-425-704-3638 |UK: 0808 2349667 |Ireland: 1-800-760647 |Australia: 1-800-151075 |New Zealand: 0800-451917 |Singapore: 800-1205517 |Malaysia: 1-800-815217 |South Africa: 080-09-83720 |India: 1800 266 3050 |

     

     

    FOR URGENT CALLBACKS PLEASE EMAIL – msperfcb@microsoft.com

    cid:image001.jpg@01CD113E.F23E8300


    The answer is 42. What was the question?

    Monday, April 09, 2012 11:28 PM
  • "This is a known issue with the hot fix KB2667402 which effects the file rdpcorekmts.dll"

    Then

    "To answer the question about the known issue.

    This issue has been reported to Microsoft and is under investigation. We still do not have sufficient data for it to be listed under the known issues section."

    'cuse me then it's not a known issue.  Known to them, not known in the general population of patchers.

    Monday, April 09, 2012 11:34 PM
  • Check Known Issues on kb2667402 (http://support.microsoft.com/kb/2667402)

    Reinstall of update 2667402 fixed the issue for me.

    If you don't want to restart - just stop the rdp-service, install update 2667402 and start rdp-service.

    "After you install security update 2667402 on a computer that is running Windows 7 or Windows Server 2008 R2, and then you install Service Pack 1 (SP1) for Windows 7 or Windows Server 2008 R2, the binary version of Rdpcorekmts.dll is 6.1.7600.16952 and not 6.1.7601.17514. In this scenario, you may be unable to create a remote desktop session to control the Windows 7 or Windows Server 2008 R2-based computer.

    This issue occurs because the SP1 binary version of Rdpcorekmts.dll was not originally deployed when security update 2667402 was originally installed. 

    To work around this issue, visit Windows Update to reinstall security update 2667402. "

    Thursday, April 12, 2012 10:44 AM
  • Thanks 6xcamaro, It fixed my issue.

    Chritoph Muller is right

    The broken servers have 6.1.7600.16952 of rdpcorekmts.dll.

    The working servers have 6.1.7601.17767 of rdpcorekmts.dll.

    Saturday, April 14, 2012 8:14 AM
  • > Also were this problem. Solved with recheck System properties -> Remote from (less secure) to (more secure) and back. KB2667402 and 2621440 installed.

    Doing this bizarrely fixed the issue for me too.

    • Proposed as answer by thedavidtan Saturday, March 23, 2013 1:05 PM
    • Unproposed as answer by thedavidtan Saturday, March 23, 2013 1:05 PM
    Monday, April 16, 2012 4:57 PM
  • good solution. work fine 

    beginner

    Thursday, April 19, 2012 11:43 AM
  • I related this issue to our TAM. But at least in our case rebooting the problem systems is all it took.

    Edit:

    I was wrong, sort of. A reboot allowed us to RDP to the system, but only while it was completing the update to SP1, but after the system rebooted again we could no longer RDP.
    If anyone needs an easy way to fix here is a batch file I wrote up to fix our systems.
    You need to run this with a user that is an admin on the target system.
    Copy psexec and rdpcorekmts.dll (the new version) to a folder.
    Create a file named servernames.txt and add the name of the server(s) you want to fi
    Create a start.cmd file edit it and add the following:

    @echo off
    Echo *************************************************************
    echo * This process will update and change the file rdpcorekmts. *
    echo * If you don't want to do that, 'X' out now                 *
    echo *************************************************************
    pause

    :stop remote desktop services for /f %%i in (servernames.txt) do psexec \\%%i net stop "Remote Desktop Services" /y :Take Ownership for /f %%i in (servernames.txt) do psexec \\%%i takeown /F c:\windows\system32\rdpcorekmts.dll :Change permissions to full for /f %%i in (servernames.txt) do psexec \\%%i icacls c:\windows\system32\rdpcorekmts.dll /grant administrators:F :Copy in newer version for /f %%i in (servernames.txt) do copy rdpcorekmts.dll \\%%i\c$\windows\system32\ :Change permissions back to read-only for /f %%i in (servernames.txt) do psexec \\%%i icacls c:\windows\system32\rdpcorekmts.dll /grant administrators:R :start the service back up for /f %%i in (servernames.txt) do psexec \\%%i net start "Remote Desktop Services" /y Echo ******************************************************************** echo * Remove the names of the affected servers in the file Servernames * echo ******************************************************************** Echo *Should be all done now. * echo ************************** pause exit


    Double-click Start.cmd







    good solution. work fine

    beginner

    Thursday, April 19, 2012 12:08 PM
  • This also happened to me, I installed the SP1 on my windows and it is giving me the same error. My problem is that I cant log on the server from the console. The server is also were I have the Hyper V Manager installed.


    What can I do?

    Monday, April 23, 2012 1:16 PM
  • great script!

    i do want to comment that there is no need to use the dll from an unpatched system. the dll can be obtained by searching the affected server's disk. i had multiple versions of the file on my affected server and i copied the latest one which solved the problem.


    Dani Avni

    Tuesday, April 24, 2012 7:23 AM
  • Its seems Microsoft has fixed this isse , check out KB page  :

    fter you install security update 2667402 on a computer that is running Windows 7 or Windows Server 2008 R2, and then you install Service Pack 1 (SP1) for Windows 7 or Windows Server 2008 R2, the binary version of Rdpcorekmts.dll is 6.1.7600.16952 and not 6.1.7601.17514. In this scenario, you may be unable to create a remote desktop session to control the Windows 7 or Windows Server 2008 R2-based computer.
    This issue occurs because the SP1 binary version of Rdpcorekmts.dll was not originally deployed when security update 2667402 was originally installed. 
    To work around this issue, visit Windows Update to reinstall security update 2667402.

    http://support.microsoft.com/kb/2667402

    As i can understand you just need to remove and reinstall new one directly from Windows Update , not WSUS .


    Sem

    Tuesday, April 24, 2012 8:25 AM
  • The script don´t worked for me, but I ran each line separated and after this working fine.

    After psexec changed the owner from rdpcorekmts.dll I need to change the NTFS setting from rdpcorekmts.dll manually I add full rights to administrators group.

    After this I deleted the file and copied the new one.

    Tuesday, April 24, 2012 2:14 PM
  • None of the above worked for me.  I had to log in locally and click "OK" to the message notifying me that SP1 has been successfully installed.

    Tuesday, April 24, 2012 2:51 PM
  • Thanks for posting.  It worked like a charm!
    Thursday, April 26, 2012 3:11 PM
  • Three words - Remote Procedure Call(RPC) the SYSTEM HKLM Tickets, tear them apart and let them default new.  It will flutter your service hosts and put your agent to work briefly but you have the exacts all you need is the right shell script to go with it.  If you lose control of your system you didnt cover your tracks good enough from me.


    hrm, The mousepen wont work in this field!

    Wednesday, May 02, 2012 4:00 PM
  • Maybe I'm misunderstanding something here, but this problem happened on only one of our Win7 x64 SP1 systems. Why were the others exempted?  They all had SP1 installed on them a long time ago, so we didn't install SP1 after KB2667402, which is what the KB note seems to say is the key. I get that the "SP1 binary version of Rdpcorekmts.dll was not originally deployed when security update 2667402 was originally installed," but all our systems installed KB2667402 more or less at the same time back in mid-March....

    Thursday, May 03, 2012 7:02 AM
  • Perfect.

    Thanks

    Monday, May 07, 2012 7:58 AM
  • Thank YOu

    Nice TricK !!

    Sunday, May 13, 2012 11:25 AM
  • Worked a Treat cheers!
    Monday, May 14, 2012 2:17 PM
  • Thanks you - this worked for me.

    Disappointing that MS have not addressed this - its a real problem when it happens on remote kit.


    Adam

    Tuesday, May 15, 2012 12:19 PM
  • After 5 + hours of fishing and fishing for answers, i was led to this rabbit hole in which, i tried replacing the DLL.. epic fail.  Ultimate stardum for me was unistalling update, restarted service (its magic) worked.
    Wednesday, May 16, 2012 6:42 PM
  • I was able to install patch KB2667402 today and that resolved my issue on W2K8 R2.  I had the same issue that was stated at the beginning of this post and it started after installing W2K8 SP1.  rdpcorekmts.dll version changed to 6.1.7601.17767 after installing this patch.

    KB2667402 http://support.microsoft.com/kb/2667402

    MS12-020: Description of the security update for Terminal Server Denial of Service Vulnerability: March 13, 2012

    Thursday, May 17, 2012 11:33 PM
  • This works for me without rebooting the server.

    Thanks :-)

    Monday, May 21, 2012 7:10 AM
  • I've removed the patch, rebooted the server. I re-install the patch (KB2667402), rebooted the server, and the problem still persists.
    Monday, May 21, 2012 2:10 PM
  • Glad I found this thread - Same issue, removing the patch & reboot worked OK.
    Wednesday, May 23, 2012 4:20 AM
  • Same issue here. 2008 R2 Server with Exchange, fresh install. SP1 install from WSUS failed, so I installed KB947821 and windows6.1-KB976932-X64.exe (KB976932) manually. This broke rdp. I used 6xCamaro's suggestion and rdp worked again.I then installed KB2667402 directly from Windows Update (it showed up under available updates without removing it) and rebooted. rdp works, and rdpcorekmts.dll now is 6.1.7601.17767, permissions were fixed automaically during the process.

    I've not yet checked everything, but our main AD Server updated nicely from WSUS, rdp never stopped working, SP1 and KB2667402 show up as successfully installed and rdpcorekmts is 6.1.7600.16952 ?!?


    • Edited by C. Pfeiffer Sunday, May 27, 2012 9:04 AM
    • Proposed as answer by Richi_ricard Friday, June 01, 2012 4:59 AM
    Sunday, May 27, 2012 8:59 AM
  • Removing KB2667402 resolved the issue. Thanks everyone.
    Friday, June 01, 2012 5:00 AM
  • How is this a resolution?  Are you sure you are patched and protected?

    Friday, June 01, 2012 5:04 AM
  • I, for one, are sure. As mentioned above, I reinstalled KB2667402 and all subsequent updates. Wrt the second server, just to be sure, I removed KB2667402 and reinstalled manually et viola, rdpcorekmts.dll is 6.1.7601.17767.

    Just removing the update is, of course, not enough.

    Friday, June 01, 2012 7:55 AM
  • Thanks, I see the eventvwr mentions about the rdpcorekmts.dll being problematic, so I followed 6xCamaro's suggestion, and I am able to RDP to my server too.  Thanks very much!
    Monday, June 04, 2012 9:26 AM
  • Its work for me. Thanks
    Wednesday, June 06, 2012 5:09 AM
  • This morning I had the same issue. After installed W2k8 R2 SP1 my RDP connections crashed. jasa007 Solutions worked for me.

    After uninstalled the KB2667402 rebooted the server (because the installation request this) and re-install the hotfix KB2667402 again everything is working fine.

    Thanks Jasa for your solution.

    Arnold

    Friday, June 15, 2012 3:22 PM
  • Hello.

    I have very similar problem with rdpcorekmts.dll version 6.1.7600.16952 file on one server 2008 R2 SP1 machine. After Server Pack 1 (KB976932) was installed, Remote Desktop service is crashing and also installation of KB2667402 is failing. Error messages are copy pasted bellow.

    Can I simply copy updated rdpcorekmts.dll version from another 2008 R2 SP1 machine or is there another way of resolving this issue? Thank you for any suggestions.

    Log Name:      Application
    Source:        Application Error
    Date:          18.6.2012. 10:01:22
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description:
    Faulting application name: svchost.exe_TermService, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
    Faulting module name: rdpcorekmts.dll, version: 6.1.7600.16952, time stamp: 0x4f1f9e66
    Exception code: 0xc0000005
    Fault offset: 0x000000000000a793
    Faulting process id: 0xde8
    Faulting application start time: 0x01cd4af303c18149
    Faulting application path: C:\Windows\System32\svchost.exe
    Faulting module path: C:\Windows\system32\rdpcorekmts.dll
    Report Id: caa49fe3-b91b-11e1-be87-00155d0a192a
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2012-06-18T08:01:22.000000000Z" />
        <EventRecordID>370421</EventRecordID>
        <Channel>Application</Channel>
        <Computer>VICO.vwsh.carnet.local</Computer>
        <Security />
      </System>
      <EventData>
        <Data>svchost.exe_TermService</Data>
        <Data>6.1.7600.16385</Data>
        <Data>4a5bc3c1</Data>
        <Data>rdpcorekmts.dll</Data>
        <Data>6.1.7600.16952</Data>
        <Data>4f1f9e66</Data>
        <Data>c0000005</Data>
        <Data>000000000000a793</Data>
        <Data>de8</Data>
        <Data>01cd4af303c18149</Data>
        <Data>C:\Windows\System32\svchost.exe</Data>
        <Data>C:\Windows\system32\rdpcorekmts.dll</Data>
        <Data>caa49fe3-b91b-11e1-be87-00155d0a192a</Data>
      </EventData>
    </Event>

    Log Name:      System
    Source:        Microsoft-Windows-WindowsUpdateClient
    Date:          18.6.2012. 10:12:32
    Event ID:      20
    Task Category: Windows Update Agent
    Level:         Error
    Keywords:      Failure,Installation
    User:          SYSTEM
    Computer:     
    Description:
    Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Windows (KB2667402).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
        <EventID>20</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>1</Task>
        <Opcode>13</Opcode>
        <Keywords>0x8000000000000028</Keywords>
        <TimeCreated SystemTime="2012-06-18T08:12:32.417872400Z" />
        <EventRecordID>126967</EventRecordID>
        <Correlation />
        <Execution ProcessID="884" ThreadID="508" />
        <Channel>System</Channel>
        <Computer>VICO.vwsh.carnet.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="errorCode">0x80070002</Data>
        <Data Name="updateTitle">Security Update for Windows (KB2667402)</Data>
        <Data Name="updateGuid">{D60A1F29-4179-4A0B-9855-0ECBE286E4F8}</Data>
        <Data Name="updateRevisionNumber">501</Data>
      </EventData>
    </Event>
    Monday, June 18, 2012 8:33 AM
  • Hi Zvonimir,

    Did you check if KB2667402 is allready installed or not? If so please uninstall the update. After that reboot the server and try installing the updateKB2667402 again but this time by hand. Not with automatic updates. In my case this resolved the issue.


    Regards, Marco


    • Edited by MMSch Monday, June 18, 2012 8:44 AM
    • Proposed as answer by zvonimir zg Monday, June 18, 2012 8:52 AM
    Monday, June 18, 2012 8:43 AM
  • Yeah, I've checked but somehow I missed KB2667402 on the listed of installed updates. Thanks, I will now try to fix the problem with reinstalling update.
    Monday, June 18, 2012 8:57 AM
  • Hi Zvonimir,

    Any results on your issue?


    Regards, Marco

    Tuesday, June 19, 2012 10:50 AM
  • Hi.

    Issue was resolved with manual reinstallation of KB2667402 although file version is still 6.1.7600.16385.

    Thanks.

    Thursday, June 21, 2012 8:31 AM
  • Thanks 6xCamero! did the trick!!!

    Justin

    Sunday, June 24, 2012 2:12 PM
  • And another -

    when is Microsoft going to fix this brain dead bug?


    Adam

    Tuesday, June 26, 2012 11:05 AM
  • Folks, they did in June when they rereleased the update.  Adam, please, if you reinstalled the MS12-020 in June and this STILL did not fix it, I need you to call 1-800-Microsoft - state that you are having issues with the JUNE version of MS12-020 and demand a support incident.

    If you have any issues email susan-at-msmvps.com

    But unless you call, no more action will be taken.

    They think they fixed it with a June version of MS12-020

    • V1.0 (March 13, 2012): Bulletin published.
    • V2.0 (June 12, 2012): Bulletin rereleased to reoffer security update KB2667402 on all supported editions of Windows 7 and Windows Server 2008 R2. Customers using Windows 7 or Windows Server 2008 R2, including those who have already successfully installed the update originally offered on March 13, 2012, should install the reoffered update. See the Update FAQ for details.
    Tuesday, June 26, 2012 1:51 PM
  • Hi Susan - I'm pleased to hear that they have issued a fix for this. I checked the update history on my latest server to suffer this bug and found that the update failed with error code 80070002 (useless error code)

    I have now manually updated the file in question, and this update continues to fail to install so I guess Ill just hide it.

    So some improvement, but servers are still becoming unreachable by RD.


    Adam

    Tuesday, June 26, 2012 3:33 PM
  • So instead of trying to fix it - (see below) you'd rather hide it?

    You receive a "0x80070002" or "0x80070003" error code after you download an update from Windows Update, from Microsoft Update, or from Windows Server Update Services:
    http://support.microsoft.com/kb/910336

    And again if servers are becoming unreachable AFTER the June release - CALL.  Nothing will get fixed unless you call.


    Tuesday, June 26, 2012 3:38 PM
  • Huh?

    One of the worst security flaws in Windows and it isn't going to get fixed unless we call?

    This has been going on since March?

    Doesn't anyone there THINK?

    If any Microsoft person could bother, PLEASE issue a fix for this. Its stupid Microsoft expects us to wade through dozens and dozens of these responses to try to figure out how to fix this. Copy a file from another machine, uninstall a patch, re-install a patch. Can't even find the patch because they are not listed in numerical order.

    I'm screwing around late at night on a customer's system trying all these things and it still doesn't work. What a bunch of incompetent crap.

    FYI: SBS 2011 in a virtual environment.

    Wednesday, June 27, 2012 2:59 AM
  • Bob.. this was fixed.

    It HAS been fixed.  In June a rerelease that fixed this issue that started in March.  If you are STILL GETTING A failure to RDP AFTER (please note I said AFTER) the June reinstall of MS12-020 then call.  Because, dude they cannot repro this because they believe they've fixed it.

    Here's the fact pattern.

    You installed MS12-020

    You then installed Wind 2k8 r2 sp1

    RDP will fail.

    Now.. install the June version of MS12-020 which is reoffered to you .

    Bob email me at susan-at-msmvps.com if you are STILL seeing RDP failure AFTER the June reoffering/reinstall of the patch.  I will set up a case for you, but if you are still even AFTER the June version of MS12-020 seeing this issue Microsoft thinks they fixed it and no additional action will be taken unless you help me.  Please help me if you are still seeing this failure after the June version of the update.

    This was FIXED (again let me be very clear for everyone reading this) - fixed with a re-release of this update in June.


    Wednesday, June 27, 2012 4:21 AM
  • P.S. just manually go to Windows update and 2667402 will be reoffered to you. 

    Or download it from here: http://www.microsoft.com/en-us/download/details.aspx?id=29169

    Wednesday, June 27, 2012 4:24 AM
  • Bob?  You still there?  Can you make sure you installed the June version of this http://www.microsoft.com/en-us/download/details.aspx?id=29169 ?  My email address is susan-at-msmvps.com, please let me know how it's going.
    Wednesday, June 27, 2012 7:35 AM
  • Please note to all reading this thread:

    As of June a rereleased version of this update has been rereleased.  Go to Microsoft Update or Windows Update or install http://www.microsoft.com/en-us/download/details.aspx?id=29169  to fix this issue.

    Wednesday, June 27, 2012 7:37 AM
  • Well I would rather it was fixed, so I tried the solution you found, thank you (your powers of google are strong)

    Sadly the update still fails after that, and now I have lost my update history.


    Adam

    Wednesday, June 27, 2012 9:38 AM
  • Just FYI: We had one machine, which did not work at all. Uninstalling of both Updates, Reinstall with and without reboot, manual installation of the package - nothing did help, the DLL version was the wrong again and again. I finally did the hack of manually replacing the DLL, because that fixed the issue immediately on the very first machine we saw it. So it might be true that there are some cases Microsoft's fix does not work - but as I fixed it weeks ago "manually", I cannot reproduce it any more.

    Best regards,
    Christoph

     
    Wednesday, June 27, 2012 6:03 PM
  • Hi Guys,

    I solved my problem by registering the dll file.

    regsvr32 "rdpcorekmts.dll"

    regards.


    • Edited by Md_Azam Thursday, June 28, 2012 12:32 PM
    Thursday, June 28, 2012 12:32 PM
  • Hi Guys,

    I solved my problem by registering the dll file.

    regsvr32 "rdpcorekmts.dll"

    regards.


    That is a very interesting information. What versions do you have (Windows and rdpcorekmts.dll)?
    Thursday, June 28, 2012 12:53 PM
  • Hello guys,

    For me worked it out uninstall the KB2621440 and KB2667402 then I installed again the KB2621440 restarted the server and I installed the KB2667402 and it worked fine. Problem solved.


    Leandro Chiesa


    Monday, July 16, 2012 2:35 PM
  • Hello Everyone,

    I have been desperately struggling to find a solution to my remote desktop problems for almost a whole week now.

    I have Windows 7, 64 bit on my office PC. When KB2667402 is installed on this PC, there is no listener on port 3389. After rebooting everything seems to have been normally started except the Remote Desktop Services UserMode Port Redirector. The other two Remote Desktop services are running, and this one also can be started manually. However it does not help.

    Before installing KB2667402 there were messages in the Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log like this:

    Listener RDP-Tcp has started listening

    After the installation there is no such message but a new one appears:

    Terminal Server role is not installed.

    Well, I don't want to install this role on my Windows 7 box, I only want to use Remote Desktop like before.

    Wednesday, July 25, 2012 11:29 AM
  • Reinstalling 2667402 has no effect (v2 version). Copy rdpcorekmst.dll older version from working servers causes the same error:

    Message = Faulting application name: svchost.exe_TermService, version: 6.1.7600.16385
    Faulting module name: rdpcorekmts.dll, version: 6.1.7601.21980 \ 6.1.7601.17828

    Any ideas?



    • Edited by AlexxN Thursday, August 23, 2012 6:13 AM
    Thursday, August 23, 2012 5:50 AM
  • You'll need to call Microsoft.  I'm not seeing this discussed anywhere as still being an issue.

    Since it's a security patch it will be a free or comp'd back to you call.

    Thursday, August 23, 2012 5:53 AM
  • Microsoft recommends turn on Firewall and install last updates - nonsense.
    Monday, August 27, 2012 4:38 AM
  • Susan,

    As no one needed RDP access to this machine i just waited to see if there would be an automatic fix. Finally we uninstalled the original march version and installed the latest version and RDP appears to work again.

    Kind of silly to fix a patch with the same patch number. Why not just issue a new patch number? It can still re-install/fix the first patch.

    Bob.

    Tuesday, October 16, 2012 11:56 PM
  • This Works for me too

    Problem occurs when install KB2667402 and KB2621440 at the same time
    The Solution is: Uninstall the both KBs and then reinstalling first KB2621440 restart the machine, and after reinstall KB2667402

    Thursday, November 08, 2012 4:12 AM
  • I had to contac Microsoft Support and here's the action plans they gave me.

    For my system - plan C - was the one that worked.

    Action plan:

    - Following are some of the recommendations to resolve the issue :

    A] Uninstall both the updates, install KB 2667402 first and reboot, and then install KB 2621440 and reboot.

    B]

    1) Connect remotely to affected server using the Computer Management Console

    2) Stop the Remote Desktop Services

    3) Take Ownership of file C:\Windows\System32\rdpcorekmts.dll and assign full NTFS permissions to your account

    4) Rename file to rdpcorekmts.old

    5) Copy file rdpcorekmts.dll from a non-patched server. The version number should be 6.1.7601.17767. You can also search for it on the same server in either software distribution folder or winsxs

    6) Start the Remote Desktop Services

    7) Test RDP login to server

    C]

    1) If the patches show installed

          Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1* (KB2621440)

          Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1* (KB2667402)

        Uninstall these patches.

    2) Run sfc /scannow to confirm that theres no file level corruption.

        Ensure that rdpcorekmts.dll file exists and is SP1 version that is it 6.1.7601.xxxx

    3) Import the following regsitry entry

           HKEY_CLASSES_ROOT\CLSID\{18b726bb-6fe6-4fb9-9276-ed57ce7c7cb2}

        Reboot the box. Post reboot ensure that 3389 is listening

    4) Import the following registry entries and try to RDP

          HKLM\SYSTEM\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}

          HKLM\SYSTEM\CurrentControlSet\services\RDPDD

    5) Reinstall the patches :

          Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1* (KB2621440)

          Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1* (KB2667402)

        Reboot and verify that RDP is still working

    Reference articles:

    2750454 Remote Desktop (RDP) after installing MS12-020 KB2667402) fails

    https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=B;en-US;2750454         

    2697236 Remote Desktop Service keeps crashing after installing updates

    https://vkbexternal.partners.extranet.microsoft.com/VKBWebService/ViewContent.aspx?scid=KB;en-US;2697236      


    • Edited by Edgonz Thursday, November 08, 2012 2:53 PM
    Thursday, November 08, 2012 2:52 PM