---

PS C:\Users\Administrator> # Read-only. Run on the AFFECTED Windows VPS, not the client PC.
PS C:\Users\Administrator> # Checks whether the listener registration/tree was deleted. No repairs/restarts.
PS C:\Users\Administrator> & {
>>     $ErrorActionPreference='Stop'
>>     function Show-RdpCheck([string]$Title,[scriptblock]$Read) {
>>         Write-Output ("`n--- "+$Title+' ---')
>>         try { & $Read | Out-String -Width 220 | Write-Output }
>>         catch { Write-Output ('READ ERROR: '+$_.Exception.Message) }
>>     }
>>     Show-RdpCheck 'Windows version' {
>>         Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
>>             Select-Object ProductName,EditionID,CurrentBuild,UBR,InstallationType | Format-List
>>     }
>>     Show-RdpCheck 'Service state' {
>>         Get-CimInstance Win32_Service -Filter "Name='TermService' OR Name='UmRdpService'" -OperationTimeoutSec 15 |
>>             Select-Object Name,State,StartMode,ProcessId | Format-Table -AutoSize
>>     }
>>     Show-RdpCheck 'Current listener and alternative control sets' {
>>         $sets=@('CurrentControlSet')+@(Get-ChildItem 'HKLM:\SYSTEM' | Where-Object PSChildName -match '^ControlSet\d{3}$' | Select-Object -ExpandProperty PSChildName)
>>         foreach($set in $sets){
>>             $root='HKLM:\SYSTEM\'+$set+'\Control\Terminal Server'
>>             $listener=$root+'\WinStations\RDP-Tcp'
>>             'CONTROL SET: '+$set
>>             if(Test-Path -LiteralPath $root){
>>                 'Terminal Server subkeys: '+((Get-ChildItem -LiteralPath $root | Select-Object -ExpandProperty PSChildName) -join ', ')
>>             } else { 'Terminal Server ROOT ABSENT' }
>>             if(Test-Path -LiteralPath $listener){
>>                 $key=Get-Item -LiteralPath $listener
>>                 try {
>>                     'Listener value count: '+$key.GetValueNames().Count
>>                     foreach($name in @('LoadableProtocol_Object','WdName','PdName','LanAdapter','PortNumber','fEnableWinStation','fLogonDisabled','UserAuthentication','SecurityLayer','MinEncryptionLevel')){
>>                         if($key.GetValueNames() -contains $name){ '{0} = {1} [{2}]' -f $name,$key.GetValue($name),$key.GetValueKind($name) }
>>                         else { $name+' = ABSENT' }
>>                     }
>>                 } finally { $key.Close() }
>>             } else { 'RDP-Tcp ABSENT' }
>>         }
>>     }
>>     Show-RdpCheck 'Installation state (read only)' {
>>         Get-ItemProperty 'HKLM:\SYSTEM\Setup' | Select-Object SystemSetupInProgress,OOBEInProgress | Format-List
>>     }
>>     Show-RdpCheck 'SYSTEM backup availability' {
>>         foreach($path in @("$env:SystemRoot\System32\config\RegBack\SYSTEM", "$env:SystemDrive\Windows.old\Windows\System32\config\SYSTEM")){
>>             if(Test-Path -LiteralPath $path){Get-Item -LiteralPath $path | Select-Object FullName,Length,LastWriteTime | Format-List}
>>             else {'ABSENT: '+$path}
>>         }
>>     }
>>     Write-Output 'END. No registry values, services or firewall settings changed.'
>> }

--- Windows version ---


ProductName      : Windows Server 2022 Standard Evaluation
EditionID        : ServerStandardEval
CurrentBuild     : 20348
UBR              : 587
InstallationType : Server





--- Service state ---

Name         State   StartMode ProcessId
----         -----   --------- ---------
TermService  Running Auto           5648
UmRdpService Running Manual         7344




--- Current listener and alternative control sets ---
CONTROL SET: CurrentControlSet
Terminal Server subkeys: AddIns, ClusterSettings, ConnectionHandler, DefaultUserConfiguration, KeyboardType Mapping, RCM, SessionArbitrationHelper, SysProcs, TerminalTypes, Utilities, VIDEO, Wds, WinStations
Listener value count: 6
LoadableProtocol_Object = ABSENT
WdName = ABSENT
PdName = ABSENT
LanAdapter = ABSENT
PortNumber = 3389 [DWord]
fEnableWinStation = 1 [DWord]
fLogonDisabled = 0 [DWord]
UserAuthentication = 0 [DWord]
SecurityLayer = 1 [DWord]
MinEncryptionLevel = 3 [DWord]
CONTROL SET: ControlSet001
Terminal Server subkeys: AddIns, ClusterSettings, ConnectionHandler, DefaultUserConfiguration, KeyboardType Mapping, RCM, SessionArbitrationHelper, SysProcs, TerminalTypes, Utilities, VIDEO, Wds, WinStations
Listener value count: 6
LoadableProtocol_Object = ABSENT
WdName = ABSENT
PdName = ABSENT
LanAdapter = ABSENT
PortNumber = 3389 [DWord]
fEnableWinStation = 1 [DWord]
fLogonDisabled = 0 [DWord]
UserAuthentication = 0 [DWord]
SecurityLayer = 1 [DWord]
MinEncryptionLevel = 3 [DWord]
CONTROL SET: ControlSet002
Terminal Server subkeys: AddIns, ClusterSettings, ConnectionHandler, DefaultUserConfiguration, KeyboardType Mapping, RCM, SessionArbitrationHelper, SysProcs, TerminalTypes, Utilities, VIDEO, Wds, WinStations
Listener value count: 2
LoadableProtocol_Object = ABSENT
WdName = ABSENT
PdName = ABSENT
LanAdapter = ABSENT
PortNumber = ABSENT
fEnableWinStation = ABSENT
fLogonDisabled = ABSENT
UserAuthentication = 0 [DWord]
SecurityLayer = 1 [DWord]
MinEncryptionLevel = ABSENT


--- Installation state (read only) ---


SystemSetupInProgress : 0
OOBEInProgress        : 0





--- SYSTEM backup availability ---


FullName      : C:\Windows\System32\config\RegBack\SYSTEM
Length        : 0
LastWriteTime : 9/15/2026 2:08:19 PM



ABSENT: C:\Windows.old\Windows\System32\config\SYSTEM

END. No registry values, services or firewall settings changed.
PS C:\Users\Administrator>