Termsrv.dll Patch Windows Server 2016 -

termsrv.dll on Windows Server 2016 is a common workaround to enable multiple concurrent Remote Desktop Protocol (RDP) sessions without purchasing expensive Remote Desktop Services (RDS) Client Access Licenses (CALs). By default, Windows Server allows only two concurrent administrative sessions; patching this file removes that restriction. Methods for Patching termsrv.dll There are two primary ways to bypass session limits: RDP Wrapper Library : A safer alternative that does not modify the original termsrv.dll

file. Instead, it acts as a layer between the Service Control Manager and Terminal Services, loading the DLL with modified parameters. Manual DLL Replacement

: Involves taking ownership of the system file, stopping the Remote Desktop service, and replacing the original DLL with a pre-patched version or editing it with a HEX editor. Step-by-Step Manual Patching Process

If you choose to manually patch the file, follow these steps strictly to avoid system instability:

fabianosrc/TermsrvPatcher: Patch termsrv.dll so that ... - GitHub termsrv.dll patch windows server 2016

RDP Wrapper: The Preferred Modern Method

RDP Wrapper (https://github.com/sebaxakerhtc/rdpwrap) works by loading a custom DLL (rdpwrap.dll) and an INI configuration file (rdpwrap.ini) that contains patching patterns for various termsrv.dll versions.

Advantages over direct patching:

  • No need to disable integrity checks.
  • Survives many Windows updates (if you update the INI file).
  • Easy rollback.

For Windows Server 2016:

  1. Download RDP Wrapper from GitHub.
  2. Run install.bat as Administrator.
  3. Edit C:\Program Files\RDP Wrapper\rdpwrap.ini to include the correct pattern for your Server 2016 build (or find an updated INI online).
  4. Restart the Terminal Services service.

Check status with RDPCheck.exe (bundled). If it shows "Listening on port 3389" and "Supported" with unlimited connections, you succeeded. termsrv

It is highly recommended to use a known tool like "RDPWrapper" instead of raw byte patching if this specific script fails.

Alternatives to the termsrv.dll Patch

If you need concurrent RDP sessions legally and reliably, consider:

  1. RDS CALs (Standard or Datacenter) – The Microsoft-supported path. Purchase per-user or per-device CALs.
  2. Third-party remote access tools – TeamViewer, AnyDesk, Splashtop (some allow multiple concurrent connections).
  3. Linux with XRDP – If workloads allow, switch to Ubuntu/CentOS with XRDP, which has no session limits.
  4. Windows 10/11 Multi-Session – Available only in Azure (Windows 10 Enterprise Multi-Session), but not on-prem.
  5. VNC + SSH tunneling – For lab use only – VNC allows unlimited GUI connections but lacks RDP’s performance.

Method A: Automatic (Recommended)

Using a PowerShell script is safer and easier than manually editing bytes.

  1. Open Windows PowerShell as Administrator.
  2. Paste the following script into the console window and press Enter. Note: This script usually works for Windows Server 2016. It searches for the specific byte pattern and replaces it.
# Warning: Run as Administrator
# This script stops the service, patches the DLL, and restarts the service.

$path = "C:\Windows\System32\termsrv.dll"


Use Cases (Legitimate Scenarios)


While patching violates Microsoft’s EULA, legitimate non-production use cases include: RDP Wrapper: The Preferred Modern Method RDP Wrapper


    

  • Lab environments – Testing applications that require 3+ simultaneous RDP users.
    • 

  • Legacy internal tools – Small teams accessing a single server without CAL budget.
    • 

  • Disaster recovery – Temporarily allowing more admins during an incident.
    • 

  • Training – Classroom setups where multiple students need GUI access.
    • 

  • Home labs – Homelab enthusiasts running Windows Server 2016 on low-cost hardware.
    • 





Warning: Never use this patch in a production environment, on servers with customer data, or in any scenario requiring compliance (HIPAA, PCI-DSS, SOX).






Step 8: Test Multiple Sessions


From different PCs or using mstsc /admin variations, try opening 3+ concurrent RDP connections.




Method 1: Manual Hex Patching (Recommended)


This method gives you full control and works across all Server 2016 builds.


Common Issues and Fixes


    

  • Connection Issues: If remote desktop connections are not working as expected after a patch, ensure that the patch is compatible with any third-party software or configurations in use.
    • 

  • Rollback: In cases where a patch causes issues, Microsoft may provide guidance on how to roll back the update or offer a newer patch to resolve the problem.
    •