query session command gives error code 5 even when AllowRemoteRPC is set to 1

Question

in cmd, 'Query Session' command is returning,

Error 5 getting sessionnames
Error [5]:Access is denied

on Windows 10 Remote desktop - Administrator user.

we have set, AllowRemoteRPC 's value to 1

under this HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

But still problem persists.

Questions:

• what does AllowRemoteRPC actually do and how it's value is being used.
• what to do to make Query Session command work.

Answer 1

I think the problem is in the UAC remote restrictions.

Do this on the target computer:

• Run regedit

• Navigate to the following registry subkey:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  

• If an entry named LocalAccountTokenFilterPolicy registry entry does not exist, create it as DWORD

• Double-click LocalAccountTokenFilterPolicy and set its value to 1.

Reference:

Microsoft's Description of User Account Control and remote restrictions in Windows Vista.

Answer 2

Rather than changing registry values, you could always use PSEXEC from a command prompt or Invoke-Command from a PowerShell prompt to execute QWINSTA locally. Both of these will require you have administrative rights on the remote machine (which means opening the command prompt under other credentials, including the credentials as PSEXEC switches or, in the case of PowerShell, including -Credential (Get-Credential) in the command.

Command prompt example:

PSEXEC \\MYPC cmd /c "qwinsta /server:localhost"

PowerShell example:

Invoke-Command -ComputerName MyPC -ScriptBlock { qwinsta /server:localhost }

Answer 3

For me the error 5 goes active after a few days uptime, using the PC locally or remotely.

I have already set LocalAccountTokenFilterPolicy=1 and AllowRemoteRPC=1 without help.

Reboot helps, but i don't want to...

Restarting terminal services was the solution; eg as administrator from command prompt (when local)

net stop TermService
net start TermService

Or via services.msc where it is called "Remote Desktop Services", which should work also over remote desktop.