Technical Information
- [<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'
- %ProgramFiles%\terminalserver\logging\terminalserver.log
- %HOMEPATH%\ntuser
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /dl /n "TerminalServer Printer" /q' (with hidden window)
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /dl /n "TerminalServer Printer" /q
- '<SYSTEM32>\spoolsv.exe'