UAC Causes Remote Desktop to freeze

[xuxuedong]

stuck when i open task manager on remote desktop at that moment, the cpu consume is larger than the normal

tested server os: win10_pro_x64_cn test client os: win8.1_pro_x64_cn

[Aholicknight]

Could you post your log so we can further help?

[xuxuedong]

log? windows event log? there is none log file within the current directory

[xuxuedong]

as i see, it isn't stuck, the picture is changing, just unresponsible when i click after started task manager

[xuxuedong]

but when i tested: server os: win10_pro_x64_cn client os: xp_pro_x86_cn i use remote desktop to operate xp, it's responsible when i click after i started task manager

in addition, i found the cpu consume is normal

[Aholicknight]

So is this issue fixed?

[MaxXor]

@trollmad3 No, it's not on Windows 8.1.

[Aholicknight]

When I get home, I will create a windows 8.1 virtual machine and see if I could do anything to fix this.

[mystyq]

This behavior also occurs when opening chrome browser (temporarily).

[mystyq]

I believe the problem is related to the mouse_event WinAPI calls. If you run the task manager as administrator it seems to work. mouse_event is deprecated and I wonder if switching to SendInput calls would fix this.

[xuxuedong]

@mystyq yeah, you are right, i tested the client run as admin on win8.1, it's no problem

[ghost]

Adding to mystyq's answer/solution. User32 has plenty of undocumented features for injecting keyboard or mouse input. Even for touch input.

See user32!InjectDeviceInput, user32!InjectGenericHidInput, user32!InjectKeyboardInput, user32!InjectMouseInput, user32!InjectPointerInput, user32!InjectTouchInput

Here's some sample code for Visual Basic .NET https://github.com/Nukepayload2/Nukepayload2.Diagnostics.InputInjection/blob/00600d8a22e9ea1ba8ef284a0e2c6ed552d9192e/Nukepayload2.Diagnostics.InputInjection/Preview/UnsafeNativeMethods.vb

And I took the time to write a demonstration in C# https://github.com/gigajew/KeyboardInjection