This restriction is hardcoded into the Remote Desktop Services subsystem, specifically governed by the termsrv.dll (Terminal Services Library) file located in the C:\Windows\System32 directory.
Create a system restore point or backup the original termsrv.dll located in C:\Windows\System32\ .
fabianosrc/TermsrvPatcher: Patch termsrv.dll so that ... - GitHub termsrv.dll patch windows server 2016
: Download a reliable hex editor like HxD if you plan to modify the file manually. Step-by-Step Guide to Patching termsrv.dll
For a safer, official way to manage session limits, you can adjust settings within the Local Group Policy Editor This restriction is hardcoded into the Remote Desktop
Automated scripts are the most common way to apply this patch.
Search for the specific byte pattern matching your build version and replace it. 39 81 3C 06 00 00 0F 84 X X X X Pattern to replace: B8 00 01 00 00 90 89 81 3C 06 00 00 - GitHub : Download a reliable hex editor
Alternatively, run this command in PowerShell as an Administrator: powershell Stop-Service -Name "TermService" -Force Use code with caution. Step 2: Take Ownership of termsrv.dll
39 81 3C 06 00 00 0F 84
Patching termsrv.dll circumvents Microsoft’s licensing requirements for multi‑user RDP access. While this is technically feasible, it violates the End User License Agreement (EULA) for Windows Server 2016. Organisations should evaluate their compliance posture before deploying the patch in production environments. For any commercial or critical deployment, purchasing the appropriate RDS CALs is the recommended, legally sound path.
Comprehensive Guide to Patching termsrv.dll for Multiple RDP Sessions on Windows Server 2016
