'Remote Desktop Services' Services keeps setting itself to 'Automatic'

  1. Thelps's Avatar
    Posts : 107
    Windows
       #1

    'Remote Desktop Services' Services keeps setting itself to 'Automatic'


    The 'Remote Desktop Services' service (under Services.msc) keeps setting itself to 'Automatic'.

    Does anyone know how to stop this? I've set it to 'Disabled' and turned off the service multiple times but it seems to automatically set itself to 'Automatic' and activate itself. This even happens without restarting the computer.

    Is this indicative of malware/virus activity?

    How can I ensure this service remains disabled?

    I've long suspected this computer is hacked and this activity could be associated with remote access of one form or another. If this indicates known malware please inform me of the usual suspects.

    Much appreciated.
      My Computer

  2. TairikuOkami's Avatar
    Posts : 4,973
    Windows 11 Home
       #2

    It is definitely not normal, especially for this service. Pick 2-3 scanners and check for malware.

    10 Free and Portable Offline Antivirus Scanners

    Try this, run CMD as admin and copy/paste:
    Code:
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnsolicited" /t REG_DWORD /d "0" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "fAllowUnsolicitedFullControl" /t REG_DWORD /d "0" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "fDenyTSConnections" /t REG_DWORD /d "1" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "TSAppCompat" /t REG_DWORD /d "0" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "TSEnabled" /t REG_DWORD /d "0" /f
    reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "TSUserEnabled" /t REG_DWORD /d "0" /f
    schtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable
    schtasks /End /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask"
    sc config TermService start= disabled
    net stop TermService /y
      My Computer


  3. Posts : 287
    win 10 home
       #3

    A few years ago, a Norton user was ranting about the security software resetting the Service to 'Automatic'. No one in the Norton Support Forum volunteered to prove the user wrong/right.

    My own experience, and I use Norton, says a reboot resets the Service to 'Automatic'. When I had the occasion to check, it usually shows it as previously set, 'Disabled'. Only after a reboot does it show the Service running.

    It's an inconvenience, the reflexive checking, I've learned to live with.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 04:33.
Find Us




Windows 10 Forums