0

Have Windows 2012 Server and very very strange problem because my client (noobie admin) did something with configuration in RemoteAPP and ask now for support because he is not familiar much witch RemoteAPP.

So.. At 1st month Published RemoteAPP worked without any issues. Then Client ( noobie admin) added RD Gateway role to test with NAP Role. Then did many tests and now every Published Remote APP run cmd.exe. I don't know why cmd.exe is running with every remote app ? :/ Collections have now ONLY Calc.exe. When I run it over RemoteAPP it cause another window with CMD.exe. What the hell is going on ? I'm fighting with this over 2 weeks and I gave up. But client (noobie admin) do not want me to Prepare new Server with RemoteAPP He wants me to fix old one....

My try:

  • Removed RD Gateway Role and NAP Role - not help

  • Removed Remote APP - and Deployed as new - not help

  • Deleted collections - not help

  • removed [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\CentralPublishedResources\PublishedFarms\QuickSessionCollection] key

Still cmd.exe runs with calc.exe or any other Published APP. So when I run 3 RemoteAPP aplications I have 3 additional windows with cmd.exe :/

Curl User
  • 75
  • 1
  • 3
  • 10
  • with a "noobie admin" you cannot be sure, the issue is related with anything he claims he did. check `assoc .exe` (should give `exefile`) and `ftype exefile` (should give `"%1" %*`) – Stephan Feb 15 '17 at 08:38
  • assoc.exe return **.exe=exefile** and ftype exefile return **exefile="%1" %*** – Curl User Feb 15 '17 at 11:40
  • Interesting thing I've found cmd.exe during remote app is executed by C:\windows\system32\cmd.exe sethc.exe 11 When I run cmd.exe on server directly there is no sethc.exe 11. So maybe its source my problems ? How to fix it ...? – Curl User Feb 16 '17 at 12:31

1 Answers1

0

Finally found problem - answer is on another forum: https://www.experts-exchange.com/questions/28976558/Command-Prompt-opening-when-connecting-to-RemoteApp-using-RDP-file.html#answer41857790

Had to delete infected regedit key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution\sethc.exe

Curl User
  • 75
  • 1
  • 3
  • 10