Jump to content

Recommended Posts

Posted (edited)

Hi, I am trying the fix an RDP issue with Windows 11 24H2 by copying some Windows 11 23H2 files in C:\System32, C:\System23\nl-NL and c:\windows\SystemResources.
Basically I am doing the following:

  • Run script as #RequiredAdmin
  • FileInstall Win11 RDP files in %temp%
  • Run takeown,exe on de files in C:\Windows to make Administrator owner of the files
  • With iCacls, grant Administrator full rights on the file
  • Copy the files for backup to a folder in c:\Windows\_RDPFilesBackup
  • Copy the 23H2 files (6 files) to the c:\windows using FileCopy + $overwrite flag
  • Set ownership and permission back to the original

Copying the first files to C:\System32 and C:\System23\nl-NL is no problem.
However when the filecopy try to copy the files to c:\windows\SystemResources, the 2 files get deleted.

I checked the user/admin has rights to overwrite the files.
When I replace the copy to c:\windows\SystemResources by using  Runwait (@comSpec / Copy), the files do get overwritten without problem.

I asked ChatGPT to explain this behaviour for FileCopy ()  and it replied that FileCopy deletes the file first and then copy the new file.
If the last step fails, this means the files deleted without being replaced, thus just being deleted.

  1. Is this behaviour of FileCopy () right?
  2. If so, why does this not happen with the files for the other folder?
    (all folders have the same permission set)
  3. Why does Dos Copy work and FileCopy () fails ?

I hope someone can explain this...
 

I am not able to post a the source yet, for I tried to create it with an AI and it is a mess.
The next couple of days I try to do post a working excerpt if some of you would like to test this crazy behaviour of FileCopy () :)

 

Edited by Jemboy
Posted (edited)
5 hours ago, Jos said:

Something with x86 and x64 Modes? 

I am executing the script on a Win 11 x64 machine and the script is running in x64 mode...

Before copying I do a FileExists check to be sure I am really doing a writeover instead op copying to another place.
When copying the files, I am using the same source and target variabeles as I use with the FileCopy.

;$ResFC = FileCopy($aFiles[$i][0], $aFiles[$i][1], $FC_OVERWRITE)
$ResFC = RunWait(@ComSpec & ' /c COPY "' & $aFiles[$i][0] & '" "' & $aFiles[$i][1] & '" /Y', "", @SW_HIDE)

 

Edited by Jemboy
Posted
4 hours ago, argumentum said:

Am using RDP from 10(2004)  to 11(24H2) without a problem. What is the issue ?

We are running a legacy RDP server and after the upgrade of our Windows 11 computers, I got complaints about the server screen going beserrk.
Initially because these 2 users, recently had their computer renewed with Windows 11 24H2, I suspected the Intel graphic card.
However reinstalling the computers with 23H2 (we have Win11 23H2 PC running fine), I discovered that Win 11 24H2 must have been the culprit.

Googling ultimately let me to site  https://www.petenetlive.com/kb/article/0001901 and some other sites, to point to the mstsc* files being updated in 24H2.
To mitigate the problem, I am writing a script overwrite the 24H2 mstsc* files bij the ones from 23H2,
I am keeping my fingers crossed that the issue wil be resolved in the next months or we will be having enough time to update the legacy server to Windows Server 2025.:D

Having heart about Win 11 24H2 horror stories, I to am living the dream by having this RDP issue and an issue with restoring an image, made with a 3rd party diskimager not working (works with 23H2).:)

Posted (edited)

I have created an example script to illustrate the problem.
The script basically does the following:

 

  1. make a backup of "C:\Windows\SystemResources\mstscax.dll.mun"
  2. adjust the permissions so that 'mstscax.dll.mun' can be overwritten and overwrite 'mstscax.dll.mun'
  3. restore the initial situation (file and permissions)

At point 2, 'mstscax.dll.mun' disappears from the folder "C:\Windows\SystemResources" when I use FileCopy().
If I replace FileCopy() with DOS Copy (see remarked line) then 'mstscax.dll.mun' is overwritten and does not disappear!

Note: if the script does not execute properly (e.g. stopped prematurely), 'mstscax.dll.mun' can be lost or the original situation will not be restored.

#RequireAdmin
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_UseX64=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <File.au3>

$sTitle ="FileCopyTest v1.0"

$Answer = MsgBox($MB_ICONQUESTION + $mb_topmost + $MB_YESNO,$sTitle,"This script might make irreversible changes to your computer!" & @CRLF & "Do you want to continue ?")
If $Answer<>$IDYES then Exit

$sTempFolder = _TempFile(@TempDir, "TempFolder_", "")       ; Create a unique temporary folder name
$ResFC1 = FileCopy ("C:\Windows\SystemResources\mstscax.dll.mun", $sTempFolder & "\" & "mstscax.dll.mun", $FC_OVERWRITE + $FC_CREATEPATH)
MsgBox ($mb_topmost,$sTitle,"Just backupped 'mstscax.dll.mun' to " & $sTempFolder & "." & @CRLF & "FileCopy Result: " & $ResFC1)


;Takeover rights, set permission to administrators and copy 'mstscax.dll.mun' back over it self.
RunWait(@ComSpec & " /c " & 'takeown /f "C:\Windows\SystemResources\mstscax.dll.mun" /a', "", @SW_HIDE)
RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources\mstscax.dll.mun" /grant Administrators:F', "", @SW_HIDE)
$ResFC2 = FileCopy ($sTempFolder & "\" & "mstscax.dll.mun", "C:\Windows\SystemResources\mstscax.dll.mun",  $FC_OVERWRITE)
;$ResFC2 = RunWait(@ComSpec & ' /c COPY "' & $sTempFolder & "\" & "mstscax.dll.mun" & '" "' & "C:\Windows\SystemResources\mstscax.dll.mun" & '" /Y', "", @SW_HIDE)  ; THIS copy works unlike FileCopy
ShellExecute("C:\Windows\SystemResources")
MsgBox ($mb_topmost,$sTitle,"Overwrit backupped 'mstscax.dll.mun' to original location." & @CRLF & "The file 'mstscax.dll.mun' has disappeared!" & @CRLF & "FileCopy Result: " & $ResFC2)



;Change folder rights to repair missing DLL and restore all rights
RunWait(@ComSpec & " /c " & 'takeown /f "C:\Windows\SystemResources" /a', "", @SW_HIDE)
RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources" /grant Administrators:F', "", @SW_HIDE)
$ResFC3 = FileCopy ($sTempFolder & "\" & "mstscax.dll.mun", "C:\Windows\SystemResources\mstscax.dll.mun",  $FC_OVERWRITE)


RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources\mstscax.dll.mun" /setowner "NT SERVICE\TrustedInstaller" /C', "", @SW_HIDE)
RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources\mstscax.dll.mun" /grant:r Administrators:RX', "", @SW_HIDE)

RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources" /setowner "NT SERVICE\TrustedInstaller" /C', "", @SW_HIDE)
RunWait(@ComSpec & " /c " & 'icacls "C:\Windows\SystemResources" /grant:r Administrators:RX', "", @SW_HIDE)

DirRemove ($sTempFolder,$DIR_REMOVE)
MsgBox ($mb_topmost,$sTitle,"Restored 'C:\Windows\SystemResources\mstscax.dll.mun' and" & @CRLF & "Restored all to original state." & @CRLF & "FileCopy Result: " & $ResFC3)

 

Edited by Jemboy

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...