<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Hi Rob,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">It works perfect here.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Using Xymon 4.3.21 with both 2008 / 2008 R2 / 2012 / 2012 R2 with no issues at all.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><br>
Thanks for the update, I’ll deleted the RDPNLA witch was the approach I did to get it to work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">I’ll too backup on the protocols.cfg updates in the next release.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:14.0pt;color:#1F497D">Kenneth S. Petersen<br>
<br>
</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Fra:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [mailto:xymon-bounces@xymon.com]
<b>På vegne af </b>Rob Steuer<br>
<b>Sendt:</b> 19. oktober 2015 01:20<br>
<b>Til:</b> xymon@xymon.com<br>
<b>Emne:</b> [Xymon] Fix for RDP tests<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">After trying to implement the RDP tests for monitored hosts I noticed that they were returning a yellow warning with the warning text “Unexpected service response”. I tried this for older hosts running Windows 2003 and
newer hosts running 2008/2012 with RDP using NLA. It gave the warning text for both. So I’m guessing the original rdp test was implemented many years ago (2010 per below) when things were handled differently.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The specification currently in the protocols.cfg file for RDP as it stands today is as follows:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"># Microsoft Terminal Services / Remote Desktop Protocol<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"># From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[rdp]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> port 3389<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> send "\x03\x00\x00\x1e\x19\xe0\x00\x00\x00\x00\x00Cookie: mstshash=\r\n"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> expect "\x03\x00\x00\x0b\x06\xd0"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I couldn’t find anyone who provided a true fix in the archives other than suggesting doing a network trace. So that’s what I did. After a bit of testing I found the following to work:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"># Microsoft Terminal Services / Remote Desktop Protocol<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"># From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"># Updated By Rob Steuer 10-17-2015 with send and expect strings that work for current versions of RDP<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[rdp]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> port 3389<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> send "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x0b\x00\x00\x00"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> expect "\x03\x00\x00\x13\x0e\xd0\x00\x00\x12\x34"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I was tempted to rename the protocol test to [rdpnla] or something like that to keep the old one around, but really the old one just didn’t work for anything, so IMHO I think it just needs to be replaced entirely.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’d like feedback from others to see if this works for them also and see the protocols.cfg updated in the next release of Xymon.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Rob<o:p></o:p></span></p>
</div>
</body>
</html>