{"record":{"id":"0986658d5309d12c","repo":"shadow1ng/fscan","slug":"node-rdp-protocol-t125-mcs-server-reject-user","errorCode":"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER","errorMessage":"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'","messagePattern":"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/mcs.go","lineNumber":385,"sourceCode":"\n\toption, err := core.ReadUInt8(r)\n\tif err != nil {\n\t\tc.Emit(\"error\", err)\n\t\treturn\n\t}\n\n\tif !readMCSPDUHeader(option, ATTACH_USER_CONFIRM) {\n\t\tc.Emit(\"error\", errors.New(\"NODE_RDP_PROTOCOL_T125_MCS_BAD_HEADER\"))\n\t\treturn\n\t}\n\n\te, err := per.ReadEnumerates(r)\n\tif err != nil {\n\t\tc.Emit(\"error\", err)\n\t\treturn\n\t}\n\tif e != 0 {\n\t\tc.Emit(\"error\", errors.New(\"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'\"))\n\t\treturn\n\t}\n\n\tuserId, _ := per.ReadInteger16(r)\n\tuserId += MCS_USERCHANNEL_BASE\n\tc.userId = userId\n\n\tc.channels = append(c.channels, MCSChannelInfo{userId, \"user\"})\n\tc.connectChannels()\n}\n\nfunc (c *MCSClient) connectChannels() {\n\tglog.Debug(\"mcs connectChannels:\", c.channelsConnected, \":\", len(c.channels))\n\tif c.channelsConnected == len(c.channels) && c.serverNetworkData != nil {\n\t\tif c.nbChannelRequested < int(c.serverNetworkData.ChannelCount) {\n\t\t\t//static virtual channel\n\t\t\tchanId := c.serverNetworkData.ChannelIdArray[c.nbChannelRequested]\n\t\t\tc.nbChannelRequested++","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/mcs.go#L367-L403","documentation":"After a valid ATTACH_USER_CONFIRM header, recvAttachUserConfirm reads a PER-encoded result enumerator; 0 means the user attach succeeded, any non-zero result means the server refused to attach the user channel. The library emits this sentinel error (note the trailing quote typo in the message). It is the server explicitly rejecting the MCS Attach User Request.","triggerScenarios":"per.ReadEnumerates returns e != 0 when parsing the server's ATTACH_USER_CONFIRM — the server's result field indicates rejection of the attach user request.","commonSituations":"Server hit its MCS user-channel/connection limit (license or concurrency cap); the server is misconfigured or a security component blocks the session; connecting to a gateway/broker that rejects raw MCS attach; resource exhaustion on an overloaded terminal server.","solutions":["Retry later — rejection is often due to the server's concurrent-session or license limit.","Check server-side logs (Terminal Services / RDP listener) for the reject reason at this timestamp.","Verify credentials/authentication succeeded earlier; some servers reject MCS attach after failed higher-layer checks.","Confirm the target allows this client's requested channel configuration (clientNetworkData.ChannelDefArray) — excessive channel requests can trigger rejection."],"exampleFix":"// before\nif e != 0 {\n    c.Emit(\"error\", errors.New(\"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER'\"))\n    return\n}\n// after\nif e != 0 {\n    c.Emit(\"error\", fmt.Errorf(\"NODE_RDP_PROTOCOL_T125_MCS_SERVER_REJECT_USER: result=%d\", e))\n    return\n}","handlingStrategy":"retry","validationCode":"// No pre-call check possible; the result enum arrives in the confirm PDU.\n// Guard the consumer:\nif attachResult != 0 {\n    return fmt.Errorf(\"server rejected attach user (result=%d)\", attachResult)\n}","typeGuard":null,"tryCatchPattern":"mcs.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"SERVER_REJECT_USER\") {\n        // back off and retry later; check server session/license limits\n    }\n})","preventionTips":["Stay under the server's concurrent RDP session/license limits.","Check server-side RDP listener logs when rejections repeat.","Limit requested static virtual channels to what the server allows."],"tags":["rdp","mcs","server-rejection","session-limit"],"backgroundTag":"server-rejected-request","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}