query session command gives error code 5 even when AllowRemoteRPC is set to 1

Question

in cmd, 'Query Session' command is returning,

Error 5 getting sessionnames
Error [5]:Access is denied

on Windows 10 Remote desktop - Administrator user.

we have set, AllowRemoteRPC 's value to 1

under this HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

But still problem persists.

Questions:

• what does AllowRemoteRPC actually do and how it's value is being used.
• what to do to make Query Session command work.

Answer 1

I think the problem is in the UAC remote restrictions.

Do this on the target computer:

• Run regedit

• Navigate to the following registry subkey:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  

• If an entry named LocalAccountTokenFilterPolicy registry entry does not exist, create it as DWORD

• Double-click LocalAccountTokenFilterPolicy and set its value to 1.

Reference:

Microsoft's Description of User Account Control and remote restrictions in Windows Vista.

Answer 2

Rather than changing registry values, you could always use PSEXEC from a command prompt or Invoke-Command from a PowerShell prompt to execute QWINSTA locally. Both of these will require you have administrative rights on the remote machine (which means opening the command prompt under other credentials, including the credentials as PSEXEC switches or, in the case of PowerShell, including -Credential (Get-Credential) in the command.

Command prompt example:

PSEXEC \\MYPC cmd /c "qwinsta /server:localhost"

PowerShell example:

Invoke-Command -ComputerName MyPC -ScriptBlock { qwinsta /server:localhost }