B8 00 01 00 00 89 81 3C 06 00 00 90 (Note: Hex patterns change based on the specific Windows Build/Version number.) 2. RDP Wrapper Library The most popular tool is the RDPWrap Project on GitHub .
You cannot modify termsrv.dll while the RDP service is running. Press Win + R , type services.msc , and press . Locate Remote Desktop Services . Right-click it and select Stop . Step 2: Take Ownership of the File
If you need a reliable, compliant, and permanent multi-user RDP setup on Windows Server 2016, you should install the official Remote Desktop Services role instead of patching system files. Open and click Add roles and features . Select Remote Desktop Services installation . Choose Quick Start or Standard deployment . Select Session-based desktop deployment . termsrv.dll patch windows server 2016
While patching can solve immediate connectivity problems, it is crucial to keep your server secure and updated.
Patching violates Microsoft's End User License Agreement (EULA). B8 00 01 00 00 89 81 3C
By following the step-by-step manual patching guide above—backing up files, using the correct hex pattern, and understanding the risks—you can safely remove the two-session limit. Just remember: every Windows Update may break the patch, and Microsoft’s licensing team will not forgive violations.
The script supports Windows Server 2016, 2019, 2022, and even Windows Server 2025 builds. It also works on client OS versions like Windows 7, 10, and 11 (including 23H2 and 24H2). Press Win + R , type services
The system protects termsrv.dll by assigning ownership to TrustedInstaller . You must take ownership to alter permissions. Open File Explorer and navigate to C:\Windows\System32 . Locate termsrv.dll , right-click it, and select . Go to the Security tab and click Advanced . Click Change next to the Owner field. Type Administrators and click Check Names , then click OK . Click Apply , then click OK . To do this quickly via the Command Prompt (Admin):
The patch does not remove licensing entirely—it alters the conditional logic inside the DLL. Specifically, it tricks the server into believing that: