diff --git a/dbg.txt b/dbg.txt
new file mode 100644
index 000000000..eb0e51392
--- /dev/null
+++ b/dbg.txt
@@ -0,0 +1,562 @@
+Using connection file: JohnDoeTSG.rdp
+screen mode id:i:2
+use multimon:i:0
+desktopwidth:i:1920
+desktopheight:i:1080
+session bpp:i:32
+winposstr:s:0,1,553,211,1353,811
+compression:i:1
+keyboardhook:i:2
+audiocapturemode:i:0
+videoplaybackmode:i:1
+connection type:i:7
+networkautodetect:i:1
+bandwidthautodetect:i:1
+displayconnectionbar:i:1
+enableworkspacereconnect:i:0
+disable wallpaper:i:0
+allow font smoothing:i:0
+allow desktop composition:i:0
+disable full window drag:i:1
+disable menu anims:i:1
+disable themes:i:0
+disable cursor setting:i:0
+bitmapcachepersistenable:i:1
+full address:s:LAB1-W7-DM-01.lab1.awake.local
+audiomode:i:0
+redirectprinters:i:1
+redirectcomports:i:0
+redirectsmartcards:i:1
+redirectclipboard:i:1
+redirectposdevices:i:0
+autoreconnection enabled:i:1
+authentication level:i:2
+prompt for credentials:i:0
+negotiate security layer:i:1
+remoteapplicationmode:i:0
+gatewayhostname:s:LAB1-W2K8R2-GW.lab1.awake.local
+gatewayusagemethod:i:1
+gatewaycredentialssource:i:0
+gatewayprofileusagemethod:i:1
+promptcredentialonce:i:1
+use redirection server name:i:0
+rdgiskdcproxy:i:0
+drivestoredirect:s:*
+username:s:LAB1\JohnDoe
+DBG_NEGO nego_set_negotiation_enabled (936): Enabling security layer negotiation: TRUE
+DBG_NEGO nego_enable_rdp (948): Enabling RDP security: TRUE
+DBG_NEGO nego_enable_tls (959): Enabling TLS security: TRUE
+DBG_NEGO nego_enable_nla (972): Enabling NLA security: TRUE
+DBG_NEGO nego_enable_ext (984): Enabling NLA extended security: TRUE
+DBG_NEGO nego_connect (135): state: NEGO_STATE_EXT
+DBG_NEGO nego_attempt_ext (311): Attempting NLA extended security
+connected to LAB1-W2K8R2-GW.lab1.awake.local:443
+connected to LAB1-W2K8R2-GW.lab1.awake.local:443
+DBG_RPC rpc_ntlm_http_out_connect (531): 
+RPC_OUT_DATA /rpc/rpcproxy.dll?localhost:3388 HTTP/1.1
+Cache-Control: no-cache
+Connection: Keep-Alive
+Pragma: ResourceTypeUuid=44e265dd-7daf-42cd-8560-3cdb6e7a2729, SessionId=fbd9c34f-397d-471d-a109-1b08cc554624
+Accept: application/rpc
+User-Agent: MSRPC
+Content-Length: 0
+Host: LAB1-W2K8R2-GW.lab1.awake.local
+Authorization: NTLM TlRMTVNTUAABAAAAt4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=
+
+
+DBG_RPC rpc_ntlm_http_out_connect (554): 
+RPC_OUT_DATA /rpc/rpcproxy.dll?localhost:3388 HTTP/1.1
+Cache-Control: no-cache
+Connection: Keep-Alive
+Pragma: ResourceTypeUuid=44e265dd-7daf-42cd-8560-3cdb6e7a2729, SessionId=fbd9c34f-397d-471d-a109-1b08cc554624
+Accept: application/rpc
+User-Agent: MSRPC
+Content-Length: 76
+Host: LAB1-W2K8R2-GW.lab1.awake.local
+Authorization: NTLM TlRMTVNTUAADAAAAGAAYAIQAAABmAWYBnAAAAAgACABYAAAADgAOAGAAAAAWABYAbgAAABAAEAACAgAANbKI4gYBsR0AAAAP1XRhe0uRkAJWYmUo95qq1EwAQQBCADEASgBvAGgAbgBEAG8AZQB3AG8AcgBrAHMAdABhAHQAaQBvAG4AtHOZ0qxcgvISeR8/UBclGBidsMGFzfwETzfdBTmBkWvkhg+2WZjg3wEBAAAAAAAAuNIO48W3zQEYnbDBhc38BAAAAAACAAgATABBAEIAMQABABwATABBAEIAMQAtAFcAMgBLADgAUgAyAC0ARwBXAAQAIABsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAMAPgBMAEEAQgAxAC0AVwAyAEsAOABSADIALQBHAFcALgBsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAUAIABsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAcACAC40g7jxbfNAQYABAACAAAACgAQAAAAAAAAAAAAAAAAAAAAAAAJAEgASABUAFQAUAAvAEwAQQBCADEALQBXADIASwA4AFIAMgAtAEcAVwAuAGwAYQBiADEALgBhAHcAYQBrAGUALgBsAG8AYwBhAGwAAAAAAAAAAAAAAAAAAAAAAH11WLRsIanYKVPhXsB3JBQ
+
+
+DBG_RPC rts_send_CONN_A1_pdu (387): Sending CONN_A1 RTS PDU
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RTS (20)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 76
+auth_length: 0
+call_id: 0
+rpc_out_write(): length: 76
+0000 05 00 14 03 10 00 00 00 4c 00 00 00 00 00 00 00 ........L.......
+0010 00 00 04 00 06 00 00 00 01 00 00 00 03 00 00 00 ................
+0020 4b 1b 94 ad f4 fd 62 16 5d 09 97 72 46 44 12 43 K.....b.]..rFD.C
+0030 03 00 00 00 84 32 4b 9a c2 6f a7 a7 17 86 42 6a .....2K..o....Bj
+0040 2f 95 da 2b 00 00 00 00 00 00 01 00             /..+........
+
+DBG_RPC rpc_ntlm_http_in_connect (594): 
+RPC_IN_DATA /rpc/rpcproxy.dll?localhost:3388 HTTP/1.1
+Cache-Control: no-cache
+Connection: Keep-Alive
+Pragma: ResourceTypeUuid=44e265dd-7daf-42cd-8560-3cdb6e7a2729
+Accept: application/rpc
+User-Agent: MSRPC
+Content-Length: 0
+Host: LAB1-W2K8R2-GW.lab1.awake.local
+Authorization: NTLM TlRMTVNTUAABAAAAt4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=
+
+
+DBG_RPC rpc_ntlm_http_in_connect (617): 
+RPC_IN_DATA /rpc/rpcproxy.dll?localhost:3388 HTTP/1.1
+Cache-Control: no-cache
+Connection: Keep-Alive
+Pragma: ResourceTypeUuid=44e265dd-7daf-42cd-8560-3cdb6e7a2729
+Accept: application/rpc
+User-Agent: MSRPC
+Content-Length: 1073741824
+Host: LAB1-W2K8R2-GW.lab1.awake.local
+Authorization: NTLM TlRMTVNTUAADAAAAGAAYAIQAAABmAWYBnAAAAAgACABYAAAADgAOAGAAAAAWABYAbgAAABAAEAACAgAANbKI4gYBsR0AAAAPimP66NS3bRER/eyd7PKlUUwAQQBCADEASgBvAGgAbgBEAG8AZQB3AG8AcgBrAHMAdABhAHQAaQBvAG4AvbF0mfNPxNH97Rk7dGAFCmCJ3CuqCQSGCQff5gwE2hIhttKkEpcHZwEBAAAAAAAAuNIO48W3zQFgidwrqgkEhgAAAAACAAgATABBAEIAMQABABwATABBAEIAMQAtAFcAMgBLADgAUgAyAC0ARwBXAAQAIABsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAMAPgBMAEEAQgAxAC0AVwAyAEsAOABSADIALQBHAFcALgBsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAUAIABsAGEAYgAxAC4AYQB3AGEAawBlAC4AbABvAGMAYQBsAAcACAC40g7jxbfNAQYABAACAAAACgAQAAAAAAAAAAAAAAAAAAAAAAAJAEgASABUAFQAUAAvAEwAQQBCADEALQBXADIASwA4AFIAMgAtAEcAVwAuAGwAYQBiADEALgBhAHcAYQBrAGUALgBsAG8AYwBhAGwAAAAAAAAAAAAAAAAAAAAAAJACPQufbPfsgjgoiKl7sDI
+
+
+DBG_RPC rts_send_CONN_B1_pdu (434): Sending CONN_B1 RTS PDU
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RTS (20)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 104
+auth_length: 0
+call_id: 0
+rpc_in_write() length: 104
+0000 05 00 14 03 10 00 00 00 68 00 00 00 00 00 00 00 ........h.......
+0010 00 00 06 00 06 00 00 00 01 00 00 00 03 00 00 00 ................
+0020 4b 1b 94 ad f4 fd 62 16 5d 09 97 72 46 44 12 43 K.....b.]..rFD.C
+0030 03 00 00 00 32 7c 6e 4f 34 32 14 d6 97 3c 5b c8 ....2|nO42...<[.
+0040 76 77 bf 47 04 00 00 00 00 00 00 40 05 00 00 00 vw.G.......@....
+0050 e0 93 04 00 0c 00 00 00 9d f4 70 b9 26 5c fc 38 ..........p.&\.8
+0060 c8 0a 8b 2c 37 f5 4d b3                         ...,7.M.
+
+HTTP/1.1 200 Success
+Content-Type:application/rpc
+Content-Length:1073741824
+
+rts_recv(): length: 8
+0000 02 00 00 00 c0 d4 01 00                         ........
+
+DBG_RTS rts_recv_pdu_commands (576): numberOfCommands:1
+DBG_RTS rts_recv_pdu_commands (591): CommandType: ConnectionTimeout (0x00000002)
+rts_recv(): length: 24
+0000 06 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 ................
+0010 02 00 00 00 c0 d4 01 00                         ........
+
+DBG_RTS rts_recv_pdu_commands (576): numberOfCommands:3
+DBG_RTS rts_recv_pdu_commands (591): CommandType: Version (0x00000006)
+DBG_RTS rts_recv_pdu_commands (591): CommandType: ReceiveWindowSize (0x00000000)
+DBG_RTS rts_recv_pdu_commands (591): CommandType: ConnectionTimeout (0x00000002)
+DBG_RPC rpc_send_bind_pdu (701): Sending bind PDU
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_BIND (11)
+pfc_flags (0x17) = { PFC_FIRST_FRAG PFC_LAST_FRAG PFC_PENDING_CANCEL PFC_CONC_MPX }
+packed_drep[4]: 10 00 00 00
+frag_length: 164
+auth_length: 40
+call_id: 2
+rpc_in_write() length: 164
+0000 05 00 0b 17 10 00 00 00 a4 00 28 00 02 00 00 00 ..........(.....
+0010 f8 0f f8 0f 00 00 00 00 02 00 00 00 00 00 01 00 ................
+0020 dd 65 e2 44 af 7d cd 42 85 60 3c db 6e 7a 27 29 .e.D.}.B.`<.nz')
+0030 01 00 03 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 .....]..........
+0040 2b 10 48 60 02 00 00 00 01 00 01 00 dd 65 e2 44 +.H`.........e.D
+0050 af 7d cd 42 85 60 3c db 6e 7a 27 29 01 00 03 00 .}.B.`<.nz')....
+0060 2c 1c b7 6c 12 98 40 45 03 00 00 00 00 00 00 00 ,..l..@E........
+0070 01 00 00 00 0a 05 00 00 00 00 00 00 4e 54 4c 4d ............NTLM
+0080 53 53 50 00 01 00 00 00 97 82 08 e2 00 00 00 00 SSP.............
+0090 00 00 00 00 00 00 00 00 00 00 00 00 06 01 b1 1d ................
+00a0 00 00 00 0f                                     ....
+
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_BIND_ACK (12)
+pfc_flags (0x17) = { PFC_FIRST_FRAG PFC_LAST_FRAG PFC_PENDING_CANCEL PFC_CONC_MPX }
+packed_drep[4]: 10 00 00 00
+frag_length: 354
+auth_length: 262
+call_id: 2
+rpc_recv_pdu: length: 354
+0000 05 00 0c 17 10 00 00 00 62 01 06 01 02 00 00 00 ........b.......
+0010 f8 0f f8 0f d9 01 02 00 05 00 33 33 38 38 00 00 ..........3388..
+0020 02 00 00 00 00 00 00 00 04 5d 88 8a eb 1c c9 11 .........]......
+0030 9f e8 08 00 2b 10 48 60 02 00 00 00 03 00 03 00 ....+.H`........
+0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+0050 00 00 00 00 0a 05 00 00 00 00 00 00 4e 54 4c 4d ............NTLM
+0060 53 53 50 00 02 00 00 00 08 00 08 00 38 00 00 00 SSP.........8...
+0070 15 82 89 e2 d7 e3 c1 fd 61 c4 eb 43 00 00 00 00 ........a..C....
+0080 00 00 00 00 c6 00 c6 00 40 00 00 00 06 01 b1 1d ........@.......
+0090 00 00 00 0f 4c 00 41 00 42 00 31 00 02 00 08 00 ....L.A.B.1.....
+00a0 4c 00 41 00 42 00 31 00 01 00 1c 00 4c 00 41 00 L.A.B.1.....L.A.
+00b0 42 00 31 00 2d 00 57 00 32 00 4b 00 38 00 52 00 B.1.-.W.2.K.8.R.
+00c0 32 00 2d 00 47 00 57 00 04 00 20 00 6c 00 61 00 2.-.G.W... .l.a.
+00d0 62 00 31 00 2e 00 61 00 77 00 61 00 6b 00 65 00 b.1...a.w.a.k.e.
+00e0 2e 00 6c 00 6f 00 63 00 61 00 6c 00 03 00 3e 00 ..l.o.c.a.l...>.
+00f0 4c 00 41 00 42 00 31 00 2d 00 57 00 32 00 4b 00 L.A.B.1.-.W.2.K.
+0100 38 00 52 00 32 00 2d 00 47 00 57 00 2e 00 6c 00 8.R.2.-.G.W...l.
+0110 61 00 62 00 31 00 2e 00 61 00 77 00 61 00 6b 00 a.b.1...a.w.a.k.
+0120 65 00 2e 00 6c 00 6f 00 63 00 61 00 6c 00 05 00 e...l.o.c.a.l...
+0130 20 00 6c 00 61 00 62 00 31 00 2e 00 61 00 77 00  .l.a.b.1...a.w.
+0140 61 00 6b 00 65 00 2e 00 6c 00 6f 00 63 00 61 00 a.k.e...l.o.c.a.
+0150 6c 00 07 00 08 00 b8 d2 0e e3 c5 b7 cd 01 00 00 l...............
+0160 00 00                                           ..
+
+DBG_RPC rpc_send_rpc_auth_3_pdu (821): Sending auth_3 PDU
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RPC_AUTH_3 (16)
+pfc_flags (0x13) = { PFC_FIRST_FRAG PFC_LAST_FRAG PFC_CONC_MPX }
+packed_drep[4]: 10 00 00 00
+frag_length: 486
+auth_length: 454
+call_id: 2
+rpc_in_write() length: 486
+0000 05 00 10 13 10 00 00 00 e6 01 c6 01 02 00 00 00 ................
+0010 f8 0f f8 0f 00 00 00 00 0a 05 00 00 00 00 00 00 ................
+0020 4e 54 4c 4d 53 53 50 00 03 00 00 00 18 00 18 00 NTLMSSP.........
+0030 84 00 00 00 1a 01 1a 01 9c 00 00 00 08 00 08 00 ................
+0040 58 00 00 00 0e 00 0e 00 60 00 00 00 16 00 16 00 X.......`.......
+0050 6e 00 00 00 10 00 10 00 b6 01 00 00 15 b2 88 e2 n...............
+0060 06 01 b1 1d 00 00 00 0f 74 f1 c7 1d 4c b5 50 98 ........t...L.P.
+0070 78 33 af 11 bf ff 85 2a 4c 00 41 00 42 00 31 00 x3.....*L.A.B.1.
+0080 4a 00 6f 00 68 00 6e 00 44 00 6f 00 65 00 77 00 J.o.h.n.D.o.e.w.
+0090 6f 00 72 00 6b 00 73 00 74 00 61 00 74 00 69 00 o.r.k.s.t.a.t.i.
+00a0 6f 00 6e 00 c3 98 1c a3 5d 06 f9 59 97 a2 0c 56 o.n.....]..Y...V
+00b0 93 d0 78 26 51 43 93 2b 19 39 67 93 aa e1 e4 6c ..x&QC.+.9g....l
+00c0 83 43 2b 58 7b ca 9d 33 4a 02 81 65 01 01 00 00 .C+X{..3J..e....
+00d0 00 00 00 00 b8 d2 0e e3 c5 b7 cd 01 51 43 93 2b ............QC.+
+00e0 19 39 67 93 00 00 00 00 02 00 08 00 4c 00 41 00 .9g.........L.A.
+00f0 42 00 31 00 01 00 1c 00 4c 00 41 00 42 00 31 00 B.1.....L.A.B.1.
+0100 2d 00 57 00 32 00 4b 00 38 00 52 00 32 00 2d 00 -.W.2.K.8.R.2.-.
+0110 47 00 57 00 04 00 20 00 6c 00 61 00 62 00 31 00 G.W... .l.a.b.1.
+0120 2e 00 61 00 77 00 61 00 6b 00 65 00 2e 00 6c 00 ..a.w.a.k.e...l.
+0130 6f 00 63 00 61 00 6c 00 03 00 3e 00 4c 00 41 00 o.c.a.l...>.L.A.
+0140 42 00 31 00 2d 00 57 00 32 00 4b 00 38 00 52 00 B.1.-.W.2.K.8.R.
+0150 32 00 2d 00 47 00 57 00 2e 00 6c 00 61 00 62 00 2.-.G.W...l.a.b.
+0160 31 00 2e 00 61 00 77 00 61 00 6b 00 65 00 2e 00 1...a.w.a.k.e...
+0170 6c 00 6f 00 63 00 61 00 6c 00 05 00 20 00 6c 00 l.o.c.a.l... .l.
+0180 61 00 62 00 31 00 2e 00 61 00 77 00 61 00 6b 00 a.b.1...a.w.a.k.
+0190 65 00 2e 00 6c 00 6f 00 63 00 61 00 6c 00 07 00 e...l.o.c.a.l...
+01a0 08 00 b8 d2 0e e3 c5 b7 cd 01 06 00 04 00 02 00 ................
+01b0 00 00 0a 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
+01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+01d0 00 00 00 00 00 00 f5 4d 13 ac 9d e9 64 2d b1 64 .......M....d-.d
+01e0 2d 7f 03 37 bd 3b                               -..7.;
+
+DBG_TSG tsg_connect (730): rpc_connect success
+DBG_TSG tsg_proxy_create_tunnel (393): TsProxyCreateTunnel
+stub_data_pad: 0
+auth_pad_length: 0
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 156
+auth_length: 16
+call_id: 1
+rpc_in_write() length: 156
+0000 05 00 00 03 10 00 00 00 9c 00 10 00 01 00 00 00 ................
+0010 6c 00 00 00 00 00 01 00 43 56 00 00 43 56 00 00 l.......CV..CV..
+0020 00 00 02 00 52 54 43 56 04 00 02 00 01 00 00 00 ....RTCV........
+0030 01 00 01 00 00 00 00 00 01 00 00 00 01 00 00 00 ................
+0040 01 00 00 00 1f 00 00 00 8a e3 13 71 02 f4 36 71 ...........q..6q
+0050 01 00 04 00 01 00 00 00 02 40 28 00 dd 65 e2 44 .........@(..e.D
+0060 af 7d cd 42 85 60 3c db 6e 7a 27 29 01 00 03 00 .}.B.`<.nz')....
+0070 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 .]..........+.H`
+0080 02 00 00 00 0a 05 00 00 00 00 00 00 01 00 00 00 ................
+0090 0c 20 03 96 36 6a a9 79 00 00 00 00             . ..6j.y....
+
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RESPONSE (2)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 1936
+auth_length: 16
+call_id: 1
+rpc_recv_pdu: length: 1936
+0000 05 00 02 03 10 00 00 00 90 07 10 00 01 00 00 00 ................
+0010 60 07 00 00 00 00 00 00 00 00 02 00 50 43 00 00 `...........PC..
+0020 50 43 00 00 04 00 02 00 00 00 00 00 5f 03 00 00 PC.........._...
+0030 08 00 02 00 cc 31 db a3 06 b9 fa 4d a7 61 01 f0 .....1.....M.a..
+0040 33 97 9f 1d 0c 00 02 00 01 00 00 00 01 00 00 00 3...............
+0050 00 00 00 00 01 00 00 00 14 00 02 00 5f 03 00 00 ............_...
+0060 00 00 00 00 5f 03 00 00 2d 00 2d 00 2d 00 2d 00 ...._...-.-.-.-.
+0070 2d 00 42 00 45 00 47 00 49 00 4e 00 20 00 43 00 -.B.E.G.I.N. .C.
+0080 45 00 52 00 54 00 49 00 46 00 49 00 43 00 41 00 E.R.T.I.F.I.C.A.
+0090 54 00 45 00 2d 00 2d 00 2d 00 2d 00 2d 00 0d 00 T.E.-.-.-.-.-...
+00a0 0a 00 4d 00 49 00 49 00 43 00 52 00 54 00 43 00 ..M.I.I.C.R.T.C.
+00b0 43 00 41 00 62 00 4b 00 67 00 41 00 77 00 49 00 C.A.b.K.g.A.w.I.
+00c0 42 00 41 00 67 00 49 00 51 00 4c 00 6f 00 66 00 B.A.g.I.Q.L.o.f.
+00d0 6c 00 4d 00 59 00 51 00 6e 00 6d 00 62 00 70 00 l.M.Y.Q.n.m.b.p.
+00e0 4f 00 54 00 34 00 47 00 32 00 50 00 66 00 74 00 O.T.4.G.2.P.f.t.
+00f0 47 00 64 00 7a 00 41 00 4a 00 42 00 67 00 55 00 G.d.z.A.J.B.g.U.
+0100 72 00 44 00 67 00 4d 00 43 00 48 00 51 00 55 00 r.D.g.M.C.H.Q.U.
+0110 41 00 4d 00 43 00 6f 00 78 00 4b 00 44 00 41 00 A.M.C.o.x.K.D.A.
+0120 6d 00 0d 00 0a 00 42 00 67 00 4e 00 56 00 42 00 m.....B.g.N.V.B.
+0130 41 00 4d 00 54 00 48 00 30 00 78 00 42 00 51 00 A.M.T.H.0.x.B.Q.
+0140 6a 00 45 00 74 00 56 00 7a 00 4a 00 4c 00 4f 00 j.E.t.V.z.J.L.O.
+0150 46 00 49 00 79 00 4c 00 55 00 64 00 58 00 4c 00 F.I.y.L.U.d.X.L.
+0160 6d 00 78 00 68 00 59 00 6a 00 45 00 75 00 59 00 m.x.h.Y.j.E.u.Y.
+0170 58 00 64 00 68 00 61 00 32 00 55 00 75 00 62 00 X.d.h.a.2.U.u.b.
+0180 47 00 39 00 6a 00 59 00 57 00 77 00 77 00 48 00 G.9.j.Y.W.w.w.H.
+0190 68 00 63 00 4e 00 4d 00 54 00 49 00 78 00 4d 00 h.c.N.M.T.I.x.M.
+01a0 44 00 49 00 33 00 0d 00 0a 00 4d 00 44 00 45 00 D.I.3.....M.D.E.
+01b0 77 00 4d 00 44 00 49 00 79 00 57 00 68 00 63 00 w.M.D.I.y.W.h.c.
+01c0 4e 00 4d 00 7a 00 6b 00 78 00 4d 00 6a 00 4d 00 N.M.z.k.x.M.j.M.
+01d0 78 00 4d 00 6a 00 4d 00 31 00 4f 00 54 00 55 00 x.M.j.M.1.O.T.U.
+01e0 35 00 57 00 6a 00 41 00 71 00 4d 00 53 00 67 00 5.W.j.A.q.M.S.g.
+01f0 77 00 4a 00 67 00 59 00 44 00 56 00 51 00 51 00 w.J.g.Y.D.V.Q.Q.
+0200 44 00 45 00 78 00 39 00 4d 00 51 00 55 00 49 00 D.E.x.9.M.Q.U.I.
+0210 78 00 4c 00 56 00 63 00 79 00 53 00 7a 00 68 00 x.L.V.c.y.S.z.h.
+0220 53 00 4d 00 69 00 31 00 48 00 0d 00 0a 00 56 00 S.M.i.1.H.....V.
+0230 79 00 35 00 73 00 59 00 57 00 49 00 78 00 4c 00 y.5.s.Y.W.I.x.L.
+0240 6d 00 46 00 33 00 59 00 57 00 74 00 6c 00 4c 00 m.F.3.Y.W.t.l.L.
+0250 6d 00 78 00 76 00 59 00 32 00 46 00 73 00 4d 00 m.x.v.Y.2.F.s.M.
+0260 49 00 47 00 66 00 4d 00 41 00 30 00 47 00 43 00 I.G.f.M.A.0.G.C.
+0270 53 00 71 00 47 00 53 00 49 00 62 00 33 00 44 00 S.q.G.S.I.b.3.D.
+0280 51 00 45 00 42 00 41 00 51 00 55 00 41 00 41 00 Q.E.B.A.Q.U.A.A.
+0290 34 00 47 00 4e 00 41 00 44 00 43 00 42 00 69 00 4.G.N.A.D.C.B.i.
+02a0 51 00 4b 00 42 00 67 00 51 00 43 00 59 00 0d 00 Q.K.B.g.Q.C.Y...
+02b0 0a 00 73 00 4a 00 38 00 68 00 33 00 41 00 6a 00 ..s.J.8.h.3.A.j.
+02c0 75 00 38 00 31 00 32 00 56 00 73 00 56 00 39 00 u.8.1.2.V.s.V.9.
+02d0 35 00 39 00 6f 00 2f 00 68 00 30 00 6b 00 56 00 5.9.o./.h.0.k.V.
+02e0 59 00 61 00 4b 00 70 00 69 00 64 00 73 00 35 00 Y.a.K.p.i.d.s.5.
+02f0 55 00 55 00 33 00 46 00 6e 00 58 00 4e 00 31 00 U.U.3.F.n.X.N.1.
+0300 43 00 76 00 4e 00 79 00 79 00 57 00 62 00 69 00 C.v.N.y.y.W.b.i.
+0310 50 00 59 00 72 00 43 00 54 00 6c 00 48 00 39 00 P.Y.r.C.T.l.H.9.
+0320 31 00 6e 00 35 00 71 00 72 00 41 00 67 00 7a 00 1.n.5.q.r.A.g.z.
+0330 36 00 0d 00 0a 00 46 00 70 00 31 00 4b 00 46 00 6.....F.p.1.K.F.
+0340 4c 00 39 00 56 00 6d 00 4a 00 36 00 50 00 47 00 L.9.V.m.J.6.P.G.
+0350 6e 00 65 00 55 00 71 00 30 00 52 00 57 00 52 00 n.e.U.q.0.R.W.R.
+0360 37 00 53 00 46 00 57 00 44 00 4c 00 30 00 45 00 7.S.F.W.D.L.0.E.
+0370 6b 00 46 00 67 00 5a 00 41 00 57 00 34 00 63 00 k.F.g.Z.A.W.4.c.
+0380 67 00 43 00 48 00 64 00 6c 00 4f 00 4c 00 39 00 g.C.H.d.l.O.L.9.
+0390 32 00 59 00 78 00 49 00 35 00 50 00 61 00 43 00 2.Y.x.I.5.P.a.C.
+03a0 2b 00 42 00 6d 00 2b 00 31 00 48 00 75 00 4c 00 +.B.m.+.1.H.u.L.
+03b0 32 00 5a 00 65 00 0d 00 0a 00 66 00 71 00 6f 00 2.Z.e.....f.q.o.
+03c0 69 00 37 00 70 00 36 00 77 00 4a 00 58 00 67 00 i.7.p.6.w.J.X.g.
+03d0 44 00 59 00 74 00 67 00 4b 00 38 00 4f 00 67 00 D.Y.t.g.K.8.O.g.
+03e0 4a 00 43 00 62 00 57 00 4e 00 4c 00 4e 00 79 00 J.C.b.W.N.L.N.y.
+03f0 51 00 6a 00 58 00 46 00 6b 00 6d 00 79 00 6c 00 Q.j.X.F.k.m.y.l.
+0400 54 00 78 00 2f 00 48 00 35 00 4b 00 77 00 49 00 T.x./.H.5.K.w.I.
+0410 44 00 41 00 51 00 41 00 42 00 6f 00 33 00 51 00 D.A.Q.A.B.o.3.Q.
+0420 77 00 63 00 6a 00 41 00 54 00 42 00 67 00 4e 00 w.c.j.A.T.B.g.N.
+0430 56 00 48 00 53 00 55 00 45 00 0d 00 0a 00 44 00 V.H.S.U.E.....D.
+0440 44 00 41 00 4b 00 42 00 67 00 67 00 72 00 42 00 D.A.K.B.g.g.r.B.
+0450 67 00 45 00 46 00 42 00 51 00 63 00 44 00 41 00 g.E.F.B.Q.c.D.A.
+0460 54 00 42 00 62 00 42 00 67 00 4e 00 56 00 48 00 T.B.b.B.g.N.V.H.
+0470 51 00 45 00 45 00 56 00 44 00 42 00 53 00 67 00 Q.E.E.V.D.B.S.g.
+0480 42 00 41 00 79 00 6e 00 33 00 49 00 6a 00 2f 00 B.A.y.n.3.I.j./.
+0490 6e 00 54 00 6b 00 6e 00 71 00 7a 00 70 00 76 00 n.T.k.n.q.z.p.v.
+04a0 68 00 4b 00 38 00 71 00 6a 00 53 00 6c 00 6f 00 h.K.8.q.j.S.l.o.
+04b0 53 00 77 00 77 00 4b 00 6a 00 45 00 6f 00 0d 00 S.w.w.K.j.E.o...
+04c0 0a 00 4d 00 43 00 59 00 47 00 41 00 31 00 55 00 ..M.C.Y.G.A.1.U.
+04d0 45 00 41 00 78 00 4d 00 66 00 54 00 45 00 46 00 E.A.x.M.f.T.E.F.
+04e0 43 00 4d 00 53 00 31 00 58 00 4d 00 6b 00 73 00 C.M.S.1.X.M.k.s.
+04f0 34 00 55 00 6a 00 49 00 74 00 52 00 31 00 63 00 4.U.j.I.t.R.1.c.
+0500 75 00 62 00 47 00 46 00 69 00 4d 00 53 00 35 00 u.b.G.F.i.M.S.5.
+0510 68 00 64 00 32 00 46 00 72 00 5a 00 53 00 35 00 h.d.2.F.r.Z.S.5.
+0520 73 00 62 00 32 00 4e 00 68 00 62 00 49 00 49 00 s.b.2.N.h.b.I.I.
+0530 51 00 4c 00 6f 00 66 00 6c 00 4d 00 59 00 51 00 Q.L.o.f.l.M.Y.Q.
+0540 6e 00 0d 00 0a 00 6d 00 62 00 70 00 4f 00 54 00 n.....m.b.p.O.T.
+0550 34 00 47 00 32 00 50 00 66 00 74 00 47 00 64 00 4.G.2.P.f.t.G.d.
+0560 7a 00 41 00 4a 00 42 00 67 00 55 00 72 00 44 00 z.A.J.B.g.U.r.D.
+0570 67 00 4d 00 43 00 48 00 51 00 55 00 41 00 41 00 g.M.C.H.Q.U.A.A.
+0580 34 00 47 00 42 00 41 00 48 00 6d 00 4f 00 2b 00 4.G.B.A.H.m.O.+.
+0590 58 00 70 00 59 00 33 00 46 00 4f 00 78 00 31 00 X.p.Y.3.F.O.x.1.
+05a0 31 00 30 00 39 00 50 00 57 00 41 00 6b 00 75 00 1.0.9.P.W.A.k.u.
+05b0 31 00 43 00 4a 00 53 00 6a 00 44 00 55 00 49 00 1.C.J.S.j.D.U.I.
+05c0 4a 00 79 00 71 00 0d 00 0a 00 72 00 4b 00 45 00 J.y.q.....r.K.E.
+05d0 4a 00 67 00 50 00 5a 00 79 00 4c 00 46 00 41 00 J.g.P.Z.y.L.F.A.
+05e0 56 00 73 00 52 00 65 00 68 00 6d 00 76 00 78 00 V.s.R.e.h.m.v.x.
+05f0 67 00 57 00 35 00 77 00 63 00 7a 00 55 00 51 00 g.W.5.w.c.z.U.Q.
+0600 4b 00 36 00 5a 00 33 00 63 00 56 00 55 00 5a 00 K.6.Z.3.c.V.U.Z.
+0610 4f 00 72 00 38 00 48 00 46 00 37 00 2b 00 70 00 O.r.8.H.F.7.+.p.
+0620 55 00 51 00 4a 00 38 00 63 00 76 00 4f 00 53 00 U.Q.J.8.c.v.O.S.
+0630 78 00 32 00 36 00 32 00 54 00 6b 00 38 00 32 00 x.2.6.2.T.k.8.2.
+0640 4f 00 52 00 6a 00 69 00 7a 00 0d 00 0a 00 61 00 O.R.j.i.z.....a.
+0650 64 00 31 00 59 00 72 00 56 00 78 00 7a 00 4b 00 d.1.Y.r.V.x.z.K.
+0660 77 00 74 00 47 00 50 00 55 00 50 00 62 00 36 00 w.t.G.P.U.P.b.6.
+0670 66 00 51 00 7a 00 44 00 41 00 30 00 45 00 78 00 f.Q.z.D.A.0.E.x.
+0680 70 00 34 00 48 00 33 00 69 00 4b 00 78 00 7a 00 p.4.H.3.i.K.x.z.
+0690 42 00 4c 00 62 00 6c 00 44 00 73 00 76 00 42 00 B.L.b.l.D.s.v.B.
+06a0 31 00 7a 00 46 00 58 00 6a 00 44 00 75 00 52 00 1.z.F.X.j.D.u.R.
+06b0 77 00 46 00 38 00 46 00 68 00 75 00 79 00 38 00 w.F.8.F.h.u.y.8.
+06c0 6a 00 44 00 36 00 49 00 61 00 75 00 37 00 0d 00 j.D.6.I.a.u.7...
+06d0 0a 00 78 00 48 00 6e 00 56 00 78 00 6a 00 75 00 ..x.H.n.V.x.j.u.
+06e0 56 00 4d 00 4b 00 2b 00 4f 00 0d 00 0a 00 2d 00 V.M.K.+.O.....-.
+06f0 2d 00 2d 00 2d 00 2d 00 45 00 4e 00 44 00 20 00 -.-.-.-.E.N.D. .
+0700 43 00 45 00 52 00 54 00 49 00 46 00 49 00 43 00 C.E.R.T.I.F.I.C.
+0710 41 00 54 00 45 00 2d 00 2d 00 2d 00 2d 00 2d 00 A.T.E.-.-.-.-.-.
+0720 0d 00 0a 00 00 00 00 00 52 54 43 56 10 00 02 00 ........RTCV....
+0730 01 00 00 00 01 00 01 00 01 00 00 00 01 00 00 00 ................
+0740 01 00 00 00 01 00 00 00 1f 00 00 00 00 00 00 00 ................
+0750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+0760 1f 70 18 55 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 .p.U...J...L.7PG
+0770 9c 02 00 00 00 00 00 00 0a 05 00 00 00 00 00 00 ................
+0780 01 00 00 00 fd 28 d5 da 3c 12 66 e6 00 00 00 00 .....(..<.f.....
+
+TSG TunnelContext:
+0000 1f 70 18 55 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 .p.U...J...L.7PG
+
+DBG_TSG tsg_proxy_authorize_tunnel (481): TsProxyAuthorizeTunnel
+stub_data_pad: 0
+auth_pad_length: 0
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 140
+auth_length: 16
+call_id: 2
+rpc_in_write() length: 140
+0000 05 00 00 03 10 00 00 00 8c 00 10 00 02 00 00 00 ................
+0010 5c 00 00 00 00 00 02 00 00 00 00 00 1f 70 18 55 \............p.U
+0020 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 52 51 00 00 ...J...L.7PGRQ..
+0030 52 51 00 00 00 00 02 00 00 00 00 00 04 00 02 00 RQ..............
+0040 0c 00 00 00 08 00 02 00 00 00 00 00 0c 00 00 00 ................
+0050 00 00 00 00 0c 00 00 00 77 00 6f 00 72 00 6b 00 ........w.o.r.k.
+0060 73 00 74 00 61 00 74 00 69 00 6f 00 6e 00 00 00 s.t.a.t.i.o.n...
+0070 00 00 00 00 0a 05 00 00 00 00 00 00 01 00 00 00 ................
+0080 a0 b5 06 a0 a7 b4 bb 71 01 00 00 00             .......q....
+
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RESPONSE (2)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 128
+auth_length: 16
+call_id: 2
+rpc_recv_pdu: length: 128
+0000 05 00 02 03 10 00 00 00 80 00 10 00 02 00 00 00 ................
+0010 4c 00 00 00 00 00 00 00 00 00 02 00 52 50 00 00 L...........RP..
+0020 52 50 00 00 04 00 02 00 52 51 00 00 00 00 00 00 RP......RQ......
+0030 08 00 02 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
+0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+0050 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
+0060 00 00 00 00 00 00 00 00 0a 05 04 00 00 00 00 00 ................
+0070 01 00 00 00 2f 21 22 d5 c3 a7 33 7e 01 00 00 00 ..../!"...3~....
+
+DBG_TSG tsg_proxy_make_tunnel_call (564): TsProxyMakeTunnelCall
+stub_data_pad: 0
+auth_pad_length: 0
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 88
+auth_length: 16
+call_id: 3
+rpc_in_write() length: 88
+0000 05 00 00 03 10 00 00 00 58 00 10 00 03 00 00 00 ........X.......
+0010 28 00 00 00 00 00 03 00 00 00 00 00 1f 70 18 55 (............p.U
+0020 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 01 00 00 00 ...J...L.7PG....
+0030 52 47 00 00 52 47 00 00 00 00 02 00 01 00 00 00 RG..RG..........
+0040 0a 05 00 00 00 00 00 00 01 00 00 00 97 a0 e5 97 ................
+0050 56 aa 4d 78 02 00 00 00                         V.Mx....
+
+DBG_TSG tsg_proxy_create_channel (617): TsProxyCreateChannel
+stub_data_pad: 0
+auth_pad_length: 2
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 172
+auth_length: 16
+call_id: 4
+rpc_in_write() length: 172
+0000 05 00 00 03 10 00 00 00 ac 00 10 00 04 00 00 00 ................
+0010 7a 00 00 00 00 00 04 00 00 00 00 00 1f 70 18 55 z............p.U
+0020 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 00 00 02 00 ...J...L.7PG....
+0030 01 00 00 00 00 00 00 00 00 00 00 00 03 00 3d 0d ..............=.
+0040 01 00 00 00 04 00 02 00 1f 00 00 00 00 00 00 00 ................
+0050 1f 00 00 00 4c 00 41 00 42 00 31 00 2d 00 57 00 ....L.A.B.1.-.W.
+0060 37 00 2d 00 44 00 4d 00 2d 00 30 00 31 00 2e 00 7.-.D.M.-.0.1...
+0070 6c 00 61 00 62 00 31 00 2e 00 61 00 77 00 61 00 l.a.b.1...a.w.a.
+0080 6b 00 65 00 2e 00 6c 00 6f 00 63 00 61 00 6c 00 k.e...l.o.c.a.l.
+0090 00 00 00 00 0a 05 02 00 00 00 00 00 01 00 00 00 ................
+00a0 e6 7f 65 16 8f d2 c3 38 03 00 00 00             ..e....8....
+
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_RESPONSE (2)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 80
+auth_length: 16
+call_id: 4
+rpc_recv_pdu: length: 80
+0000 05 00 02 03 10 00 00 00 50 00 10 00 04 00 00 00 ........P.......
+0010 1c 00 00 00 00 00 00 00 00 00 00 00 4f ee 14 00 ............O...
+0020 4e b5 f2 40 80 15 cb 6b 44 a5 9c 5e 01 00 00 00 N..@...kD..^....
+0030 00 00 00 00 00 00 00 00 0a 05 04 00 00 00 00 00 ................
+0040 01 00 00 00 29 b7 07 76 c1 cf f5 e2 02 00 00 00 ....)..v........
+
+TSG ChannelContext:
+0000 4f ee 14 00 4e b5 f2 40 80 15 cb 6b 44 a5 9c 5e O...N..@...kD..^
+
+DBG_TSG tsg_proxy_setup_receive_pipe (691): TsProxySetupReceivePipe
+stub_data_pad: 0
+auth_pad_length: 0
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 68
+auth_length: 16
+call_id: 5
+rpc_in_write() length: 68
+0000 05 00 00 03 10 00 00 00 44 00 10 00 05 00 00 00 ........D.......
+0010 14 00 00 00 00 00 08 00 00 00 00 00 1f 70 18 55 .............p.U
+0020 b4 09 d1 4a bd e5 ac 4c ae 37 50 47 0a 05 00 00 ...J...L.7PG....
+0030 00 00 00 00 01 00 00 00 e1 99 8d 54 b6 f7 33 28 ...........T..3(
+0040 04 00 00 00                                     ....
+
+DBG_NEGO nego_send_negotiation_request (662): requested_protocols: 11
+TotalDataBytes: 51 numBuffers: 1 buffer1Length: 47 buffer2Length: 0 buffer3Length: 0
+stub_data_pad: 0
+auth_pad_length: 1
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_REQUEST (0)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 128
+auth_length: 16
+call_id: 6
+rpc_in_write() length: 128
+0000 05 00 00 03 10 00 00 00 80 00 10 00 06 00 00 00 ................
+0010 4f 00 00 00 00 00 09 00 00 00 00 00 4f ee 14 00 O...........O...
+0020 4e b5 f2 40 80 15 cb 6b 44 a5 9c 5e 00 00 00 33 N..@...kD..^...3
+0030 00 00 00 01 00 00 00 2f 03 00 00 2f 2a e0 00 00 ......./.../*...
+0040 00 00 00 43 6f 6f 6b 69 65 3a 20 6d 73 74 73 68 ...Cookie: mstsh
+0050 61 73 68 3d 4c 41 42 31 5c 4a 6f 68 6e 0d 0a 01 ash=LAB1\John...
+0060 00 08 00 0b 00 00 00 00 0a 05 01 00 00 00 00 00 ................
+0070 01 00 00 00 ad 2c 26 31 ad 11 d6 78 05 00 00 00 .....,&1...x....
+
+tsg_read: 16384, pending: 0
+rpc_vers: 5
+rpc_vers_minor: 0
+ptype: PTYPE_FAULT (3)
+pfc_flags (0x03) = { PFC_FIRST_FRAG PFC_LAST_FRAG }
+packed_drep[4]: 10 00 00 00
+frag_length: 32
+auth_length: 0
+call_id: 5
+RPC Fault PDU:
+status: ERROR_ACCESS_DENIED (0x00000005)
+DBG_NEGO nego_connect (141): Protocol Security Negotiation Failure
+Error: protocol security negotiation or connection failure
diff --git a/include/freerdp/settings.h b/include/freerdp/settings.h
index a8577b27d..bb6cee611 100644
--- a/include/freerdp/settings.h
+++ b/include/freerdp/settings.h
@@ -58,6 +58,10 @@
 /* Auto Reconnect Version */
 #define AUTO_RECONNECT_VERSION_1		0x00000001
 
+/* Cookie Lengths */
+#define MSTSC_COOKIE_MAX_LENGTH			9
+#define DEFAULT_COOKIE_MAX_LENGTH		0xFF
+
 /* Order Support */
 #define NEG_DSTBLT_INDEX			0x00
 #define NEG_PATBLT_INDEX			0x01
@@ -338,7 +342,10 @@ struct rdp_settings
 	ALIGN64 BOOL rdp_security; /* 147 */
 	ALIGN64 UINT32 ntlm_version; /* 148 */
 	ALIGN64 BOOL salted_checksum; /* 149 */
-	UINT64 paddingF[160 - 150]; /* 150 */
+	ALIGN64 BOOL ext_security; /* 150 */
+	ALIGN64 BOOL mstsc_cookie_mode; /* 151 */
+	ALIGN64 UINT32 cookie_max_length; /* 152 */
+	UINT64 paddingF[160 - 153]; /* 153 */
 
 	/* Session */
 	ALIGN64 BOOL console_audio; /* 160 */
diff --git a/libfreerdp/core/connection.c b/libfreerdp/core/connection.c
index 5a8be516b..b1e3f08c4 100644
--- a/libfreerdp/core/connection.c
+++ b/libfreerdp/core/connection.c
@@ -104,7 +104,6 @@ BOOL rdp_client_connect(rdpRdp* rdp)
 		cookie[cookie_length] = '\0';
 
 		nego_set_cookie(rdp->nego, cookie);
-		nego_set_cookie_max_length(rdp->nego, MSTSC_COOKIE_MAX_LENGTH);
 	}
 	else
 	{
@@ -120,6 +119,12 @@ BOOL rdp_client_connect(rdpRdp* rdp)
 	nego_enable_rdp(rdp->nego, settings->rdp_security);
 	nego_enable_tls(rdp->nego, settings->tls_security);
 	nego_enable_nla(rdp->nego, settings->nla_security);
+	nego_enable_ext(rdp->nego, settings->ext_security);
+
+	if (settings->mstsc_cookie_mode)
+		settings->cookie_max_length = MSTSC_COOKIE_MAX_LENGTH;
+
+	nego_set_cookie_max_length(rdp->nego, settings->cookie_max_length);
 
 	if (!nego_connect(rdp->nego))
 	{
@@ -149,11 +154,13 @@ BOOL rdp_client_connect(rdpRdp* rdp)
 	}
 
 	rdp->transport->process_single_pdu = TRUE;
+
 	while (rdp->state != CONNECTION_STATE_ACTIVE)
 	{
 		if (rdp_check_fds(rdp) < 0)
 			return FALSE;
 	}
+
 	rdp->transport->process_single_pdu = FALSE;
 
 	return TRUE;
diff --git a/libfreerdp/core/nego.c b/libfreerdp/core/nego.c
index 88151a133..62bf8e746 100644
--- a/libfreerdp/core/nego.c
+++ b/libfreerdp/core/nego.c
@@ -24,6 +24,8 @@
 #include <stdio.h>
 #include <string.h>
 
+#include <winpr/crt.h>
+
 #include <freerdp/constants.h>
 #include <freerdp/utils/memory.h>
 #include <freerdp/utils/unicode.h>
@@ -37,6 +39,7 @@
 static const char* const NEGO_STATE_STRINGS[] =
 {
 	"NEGO_STATE_INITIAL",
+	"NEGO_STATE_EXT",
 	"NEGO_STATE_NLA",
 	"NEGO_STATE_TLS",
 	"NEGO_STATE_RDP",
@@ -44,11 +47,12 @@ static const char* const NEGO_STATE_STRINGS[] =
 	"NEGO_STATE_FINAL"
 };
 
-static const char PROTOCOL_SECURITY_STRINGS[3][4] =
+static const char PROTOCOL_SECURITY_STRINGS[4][4] =
 {
 	"RDP",
 	"TLS",
-	"NLA"
+	"NLA",
+	"EXT"
 };
 
 BOOL nego_security_connect(rdpNego* nego);
@@ -63,12 +67,22 @@ BOOL nego_connect(rdpNego* nego)
 {
 	if (nego->state == NEGO_STATE_INITIAL)
 	{
-		if (nego->enabled_protocols[PROTOCOL_NLA] > 0)
+		if (nego->enabled_protocols[PROTOCOL_EXT])
+		{
+			nego->state = NEGO_STATE_EXT;
+		}
+		else if (nego->enabled_protocols[PROTOCOL_NLA])
+		{
 			nego->state = NEGO_STATE_NLA;
-		else if (nego->enabled_protocols[PROTOCOL_TLS] > 0)
+		}
+		else if (nego->enabled_protocols[PROTOCOL_TLS])
+		{
 			nego->state = NEGO_STATE_TLS;
-		else if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
+		}
+		else if (nego->enabled_protocols[PROTOCOL_RDP])
+		{
 			nego->state = NEGO_STATE_RDP;
+		}
 		else
 		{
 			DEBUG_NEGO("No security protocol is enabled");
@@ -79,29 +93,38 @@ BOOL nego_connect(rdpNego* nego)
 		{
 			DEBUG_NEGO("Security Layer Negotiation is disabled");
 			/* attempt only the highest enabled protocol (see nego_attempt_*) */
-			nego->enabled_protocols[PROTOCOL_NLA] = 0;
-			nego->enabled_protocols[PROTOCOL_TLS] = 0;
-			nego->enabled_protocols[PROTOCOL_RDP] = 0;
-			if(nego->state == NEGO_STATE_NLA)
+
+			nego->enabled_protocols[PROTOCOL_NLA] = FALSE;
+			nego->enabled_protocols[PROTOCOL_TLS] = FALSE;
+			nego->enabled_protocols[PROTOCOL_RDP] = FALSE;
+			nego->enabled_protocols[PROTOCOL_EXT] = FALSE;
+
+			if (nego->state == NEGO_STATE_EXT)
 			{
-				nego->enabled_protocols[PROTOCOL_NLA] = 1;
+				nego->enabled_protocols[PROTOCOL_EXT] = TRUE;
+				nego->enabled_protocols[PROTOCOL_NLA] = TRUE;
+				nego->selected_protocol = PROTOCOL_EXT;
+			}
+			else if (nego->state == NEGO_STATE_NLA)
+			{
+				nego->enabled_protocols[PROTOCOL_NLA] = TRUE;
 				nego->selected_protocol = PROTOCOL_NLA;
 			}
 			else if (nego->state == NEGO_STATE_TLS)
 			{
-				nego->enabled_protocols[PROTOCOL_TLS] = 1;
+				nego->enabled_protocols[PROTOCOL_TLS] = TRUE;
 				nego->selected_protocol = PROTOCOL_TLS;
 			}
 			else if (nego->state == NEGO_STATE_RDP)
 			{
-				nego->enabled_protocols[PROTOCOL_RDP] = 1;
+				nego->enabled_protocols[PROTOCOL_RDP] = TRUE;
 				nego->selected_protocol = PROTOCOL_RDP;
 			}
 		}
 
-		if(!nego_send_preconnection_pdu(nego))
+		if (!nego_send_preconnection_pdu(nego))
 		{
-			DEBUG_NEGO("Failed to send preconnection information");
+			DEBUG_NEGO("Failed to send preconnection pdu");
 			nego->state = NEGO_STATE_FINAL;
 			return FALSE;
 		}
@@ -220,8 +243,8 @@ int nego_transport_disconnect(rdpNego* nego)
 	if (nego->tcp_connected)
 		transport_disconnect(nego->transport);
 
-	nego->tcp_connected = 0;
-	nego->security_connected = 0;
+	nego->tcp_connected = FALSE;
+	nego->security_connected = FALSE;
 
 	return 1;
 }
@@ -276,6 +299,52 @@ BOOL nego_send_preconnection_pdu(rdpNego* nego)
 	return TRUE;
 }
 
+/**
+ * Attempt negotiating NLA + TLS extended security.
+ * @param nego
+ */
+
+void nego_attempt_ext(rdpNego* nego)
+{
+	nego->requested_protocols = PROTOCOL_NLA | PROTOCOL_TLS | PROTOCOL_EXT;
+
+	DEBUG_NEGO("Attempting NLA extended security");
+
+	if (!nego_transport_connect(nego))
+	{
+		nego->state = NEGO_STATE_FAIL;
+		return;
+	}
+
+	if (!nego_send_negotiation_request(nego))
+	{
+		nego->state = NEGO_STATE_FAIL;
+		return;
+	}
+
+	if (!nego_recv_response(nego))
+	{
+		nego->state = NEGO_STATE_FAIL;
+		return;
+	}
+
+	DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
+
+	if (nego->state != NEGO_STATE_FINAL)
+	{
+		nego_transport_disconnect(nego);
+
+		if (nego->enabled_protocols[PROTOCOL_NLA])
+			nego->state = NEGO_STATE_NLA;
+		else if (nego->enabled_protocols[PROTOCOL_TLS])
+			nego->state = NEGO_STATE_TLS;
+		else if (nego->enabled_protocols[PROTOCOL_RDP])
+			nego->state = NEGO_STATE_RDP;
+		else
+			nego->state = NEGO_STATE_FAIL;
+	}
+}
+
 /**
  * Attempt negotiating NLA + TLS security.
  * @param nego
@@ -306,13 +375,14 @@ void nego_attempt_nla(rdpNego* nego)
 	}
 
 	DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
+
 	if (nego->state != NEGO_STATE_FINAL)
 	{
 		nego_transport_disconnect(nego);
 
-		if (nego->enabled_protocols[PROTOCOL_TLS] > 0)
+		if (nego->enabled_protocols[PROTOCOL_TLS])
 			nego->state = NEGO_STATE_TLS;
-		else if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
+		else if (nego->enabled_protocols[PROTOCOL_RDP])
 			nego->state = NEGO_STATE_RDP;
 		else
 			nego->state = NEGO_STATE_FAIL;
@@ -352,7 +422,7 @@ void nego_attempt_tls(rdpNego* nego)
 	{
 		nego_transport_disconnect(nego);
 
-		if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
+		if (nego->enabled_protocols[PROTOCOL_RDP])
 			nego->state = NEGO_STATE_RDP;
 		else
 			nego->state = NEGO_STATE_FAIL;
@@ -441,7 +511,7 @@ BOOL nego_recv(rdpTransport* transport, STREAM* s, void* extra)
 				if (nego->selected_protocol)
 				{
 					if ((nego->selected_protocol == PROTOCOL_NLA) &&
-							(!nego->enabled_protocols[PROTOCOL_NLA]))
+						(!nego->enabled_protocols[PROTOCOL_NLA]))
 					{
 						nego->state = NEGO_STATE_FAIL;
 					}
@@ -541,7 +611,9 @@ BOOL nego_read_request(rdpNego* nego, STREAM* s)
 
 void nego_send(rdpNego* nego)
 {
-	if (nego->state == NEGO_STATE_NLA)
+	if (nego->state == NEGO_STATE_EXT)
+		nego_attempt_ext(nego);
+	else if (nego->state == NEGO_STATE_NLA)
 		nego_attempt_nla(nego);
 	else if (nego->state == NEGO_STATE_TLS)
 		nego_attempt_tls(nego);
@@ -820,10 +892,11 @@ void nego_init(rdpNego* nego)
 
 rdpNego* nego_new(struct rdp_transport * transport)
 {
-	rdpNego* nego = (rdpNego*) xzalloc(sizeof(rdpNego));
+	rdpNego* nego = (rdpNego*) malloc(sizeof(rdpNego));
 
 	if (nego != NULL)
 	{
+		ZeroMemory(nego, sizeof(rdpNego));
 		nego->transport = transport;
 		nego_init(nego);
 	}
@@ -902,6 +975,18 @@ void nego_enable_nla(rdpNego* nego, BOOL enable_nla)
 	nego->enabled_protocols[PROTOCOL_NLA] = enable_nla;
 }
 
+/**
+ * Enable NLA extended security protocol.
+ * @param nego pointer to the negotiation structure
+ * @param enable_ext whether to enable network level authentication extended protocol (TRUE for enabled, FALSE for disabled)
+ */
+
+void nego_enable_ext(rdpNego* nego, BOOL enable_ext)
+{
+	DEBUG_NEGO("Enabling NLA extended security: %s", enable_ext ? "TRUE" : "FALSE");
+	nego->enabled_protocols[PROTOCOL_EXT] = enable_ext;
+}
+
 /**
  * Set routing token.
  * @param nego
diff --git a/libfreerdp/core/nego.h b/libfreerdp/core/nego.h
index 7d8e6a96f..31ab751a4 100644
--- a/libfreerdp/core/nego.h
+++ b/libfreerdp/core/nego.h
@@ -2,7 +2,7 @@
  * FreeRDP: A Remote Desktop Protocol Implementation
  * RDP Protocol Security Negotiation
  *
- * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
+ * Copyright 2011-2012 Marc-Andre Moreau <marcandre.moreau@gmail.com>
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,8 +17,8 @@
  * limitations under the License.
  */
 
-#ifndef __NEGO_H
-#define __NEGO_H
+#ifndef FREERDP_CORE_NEGO_H
+#define FREERDP_CORE_NEGO_H
 
 #include "transport.h"
 #include <freerdp/types.h>
@@ -31,7 +31,8 @@ enum RDP_NEG_PROTOCOLS
 {
 	PROTOCOL_RDP = 0x00000000,
 	PROTOCOL_TLS = 0x00000001,
-	PROTOCOL_NLA = 0x00000002
+	PROTOCOL_NLA = 0x00000002,
+	PROTOCOL_EXT = 0x00000008
 };
 
 /* Protocol Security Negotiation Failure Codes */
@@ -44,9 +45,14 @@ enum RDP_NEG_FAILURE_FAILURECODES
 	HYBRID_REQUIRED_BY_SERVER = 0x00000005
 };
 
+/* Authorization Result */
+#define AUTHZ_SUCCESS		0x00000000
+#define AUTHZ_ACCESS_DENIED	0x0000052E
+
 enum _NEGO_STATE
 {
 	NEGO_STATE_INITIAL,
+	NEGO_STATE_EXT, /* Extended NLA (NLA + TLS implicit) */
 	NEGO_STATE_NLA, /* Network Level Authentication (TLS implicit) */
 	NEGO_STATE_TLS, /* TLS Encryption without NLA */
 	NEGO_STATE_RDP, /* Standard Legacy RDP Encryption */
@@ -67,14 +73,11 @@ enum RDP_NEG_MSG
 
 #define EXTENDED_CLIENT_DATA_SUPPORTED				0x01
 
-#define PRECONNECTION_PDU_V1_SIZE					16
+#define PRECONNECTION_PDU_V1_SIZE				16
 #define PRECONNECTION_PDU_V2_MIN_SIZE				(PRECONNECTION_PDU_V1_SIZE + 2)
 
-#define PRECONNECTION_PDU_V1						1
-#define PRECONNECTION_PDU_V2						2
-
-#define MSTSC_COOKIE_MAX_LENGTH						9
-#define DEFAULT_COOKIE_MAX_LENGTH					0xFF
+#define PRECONNECTION_PDU_V1					1
+#define PRECONNECTION_PDU_V2					2
 
 struct rdp_nego
 {
@@ -96,7 +99,7 @@ struct rdp_nego
 	UINT32 selected_protocol;
 	UINT32 requested_protocols;
 	BOOL security_layer_negotiation_enabled;
-	BYTE enabled_protocols[3];
+	BYTE enabled_protocols[16];
 
 	rdpTransport* transport;
 };
@@ -106,6 +109,7 @@ BOOL nego_connect(rdpNego* nego);
 
 BOOL nego_send_preconnection_pdu(rdpNego* nego);
 
+void nego_attempt_ext(rdpNego* nego);
 void nego_attempt_nla(rdpNego* nego);
 void nego_attempt_tls(rdpNego* nego);
 void nego_attempt_rdp(rdpNego* nego);
@@ -128,8 +132,9 @@ void nego_init(rdpNego* nego);
 void nego_set_target(rdpNego* nego, char* hostname, int port);
 void nego_set_negotiation_enabled(rdpNego* nego, BOOL security_layer_negotiation_enabled);
 void nego_enable_rdp(rdpNego* nego, BOOL enable_rdp);
-void nego_enable_nla(rdpNego* nego, BOOL enable_nla);
 void nego_enable_tls(rdpNego* nego, BOOL enable_tls);
+void nego_enable_nla(rdpNego* nego, BOOL enable_nla);
+void nego_enable_ext(rdpNego* nego, BOOL enable_ext);
 void nego_set_routing_token(rdpNego* nego, BYTE* RoutingToken, DWORD RoutingTokenLength);
 void nego_set_cookie(rdpNego* nego, char* cookie);
 void nego_set_cookie_max_length(rdpNego* nego, UINT32 cookie_max_length);
diff --git a/libfreerdp/core/rpc.c b/libfreerdp/core/rpc.c
index a4f8b89f5..7fdffdbd6 100644
--- a/libfreerdp/core/rpc.c
+++ b/libfreerdp/core/rpc.c
@@ -4,6 +4,7 @@
  *
  * Copyright 2012 Fujitsu Technology Solutions GmbH
  * Copyright 2012 Dmitrij Jasnov <dmitrij.jasnov@ts.fujitsu.com>
+ * Copyright 2012 Marc-Andre Moreau <marcandre.moreau@gmail.com>
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -752,8 +753,8 @@ BOOL rpc_send_bind_pdu(rdpRpc* rpc)
 	offset = 116;
 	bind_pdu->auth_verifier.auth_pad_length = rpc_offset_align(&offset, 4);
 
-	bind_pdu->auth_verifier.auth_type = 0x0A;
-	bind_pdu->auth_verifier.auth_level = 0x05;
+	bind_pdu->auth_verifier.auth_type = RPC_C_AUTHN_WINNT;
+	bind_pdu->auth_verifier.auth_level = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY;
 	bind_pdu->auth_verifier.auth_reserved = 0x00;
 	bind_pdu->auth_verifier.auth_context_id = 0x00000000;
 	offset += (8 + bind_pdu->auth_length);
@@ -839,8 +840,8 @@ BOOL rpc_send_rpc_auth_3_pdu(rdpRpc* rpc)
 	offset += 4;
 	auth_3_pdu->auth_verifier.auth_pad_length = rpc_offset_align(&offset, 4);
 
-	auth_3_pdu->auth_verifier.auth_type = 0x0A;
-	auth_3_pdu->auth_verifier.auth_level = 0x05;
+	auth_3_pdu->auth_verifier.auth_type = RPC_C_AUTHN_WINNT;
+	auth_3_pdu->auth_verifier.auth_level = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY;
 	auth_3_pdu->auth_verifier.auth_reserved = 0x00;
 	auth_3_pdu->auth_verifier.auth_context_id = 0x00000000;
 
@@ -866,14 +867,14 @@ BOOL rpc_send_rpc_auth_3_pdu(rdpRpc* rpc)
 	return TRUE;
 }
 
-//if (rpc->VirtualConnection->DefaultOutChannel->ReceiverAvailableWindow < 0x00008FFF) /* Just a simple workaround */
-//	rts_send_flow_control_ack_pdu(rpc);  /* Send FlowControlAck every time AvailableWindow reaches the half */
-
 int rpc_out_read(rdpRpc* rpc, BYTE* data, int length)
 {
 	int status;
 	RPC_PDU_HEADER* header;
 
+	//if (rpc->VirtualConnection->DefaultOutChannel->ReceiverAvailableWindow < 0x00008FFF) /* Just a simple workaround */
+	//	rts_send_flow_control_ack_pdu(rpc);  /* Send FlowControlAck every time AvailableWindow reaches the half */
+
 	/* read first 20 bytes to get RPC PDU Header */
 	status = tls_read(rpc->tls_out, data, 20);
 
@@ -1074,8 +1075,8 @@ int rpc_tsg_write(rdpRpc* rpc, BYTE* data, int length, UINT16 opnum)
 
 	printf("auth_pad_length: %d\n", request_pdu->auth_verifier.auth_pad_length);
 
-	request_pdu->auth_verifier.auth_type = 0x0A;
-	request_pdu->auth_verifier.auth_level = 0x05;
+	request_pdu->auth_verifier.auth_type = RPC_C_AUTHN_WINNT;
+	request_pdu->auth_verifier.auth_level = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY;
 	request_pdu->auth_verifier.auth_reserved = 0x00;
 	request_pdu->auth_verifier.auth_context_id = 0x00000000;
 	offset += (8 + request_pdu->auth_length);
diff --git a/libfreerdp/core/rpc.h b/libfreerdp/core/rpc.h
index f6215612d..317f9b6c6 100644
--- a/libfreerdp/core/rpc.h
+++ b/libfreerdp/core/rpc.h
@@ -4,6 +4,7 @@
  *
  * Copyright 2012 Fujitsu Technology Solutions GmbH
  * Copyright 2012 Dmitrij Jasnov <dmitrij.jasnov@ts.fujitsu.com>
+ * Copyright 2012 Marc-Andre Moreau <marcandre.moreau@gmail.com>
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/libfreerdp/core/settings.c b/libfreerdp/core/settings.c
index 11b386b54..0849b262c 100644
--- a/libfreerdp/core/settings.c
+++ b/libfreerdp/core/settings.c
@@ -77,10 +77,14 @@ void settings_client_load_hkey_local_machine(rdpSettings* settings)
 		REG_QUERY_DWORD_VALUE(hKey, _T("KeyboardFunctionKeys"), dwType, dwValue, dwSize, settings->kbd_fn_keys);
 		REG_QUERY_DWORD_VALUE(hKey, _T("KeyboardLayout"), dwType, dwValue, dwSize, settings->kbd_layout);
 
+		REG_QUERY_BOOL_VALUE(hKey, _T("ExtSecurity"), dwType, dwValue, dwSize, settings->ext_security);
 		REG_QUERY_BOOL_VALUE(hKey, _T("NlaSecurity"), dwType, dwValue, dwSize, settings->nla_security);
 		REG_QUERY_BOOL_VALUE(hKey, _T("TlsSecurity"), dwType, dwValue, dwSize, settings->tls_security);
 		REG_QUERY_BOOL_VALUE(hKey, _T("RdpSecurity"), dwType, dwValue, dwSize, settings->rdp_security);
 
+		REG_QUERY_BOOL_VALUE(hKey, _T("MstscCookieMode"), dwType, dwValue, dwSize, settings->mstsc_cookie_mode);
+		REG_QUERY_DWORD_VALUE(hKey, _T("CookieMaxLength"), dwType, dwValue, dwSize, settings->cookie_max_length);
+
 		REG_QUERY_BOOL_VALUE(hKey, _T("BitmapCache"), dwType, dwValue, dwSize, settings->bitmap_cache);
 
 		REG_QUERY_BOOL_VALUE(hKey, _T("OffscreenBitmapCache"), dwType, dwValue, dwSize, settings->offscreen_bitmap_cache);
@@ -170,6 +174,7 @@ void settings_server_load_hkey_local_machine(rdpSettings* settings)
 	if (status != ERROR_SUCCESS)
 		return;
 
+	REG_QUERY_BOOL_VALUE(hKey, _T("ExtSecurity"), dwType, dwValue, dwSize, settings->ext_security);
 	REG_QUERY_BOOL_VALUE(hKey, _T("NlaSecurity"), dwType, dwValue, dwSize, settings->nla_security);
 	REG_QUERY_BOOL_VALUE(hKey, _T("TlsSecurity"), dwType, dwValue, dwSize, settings->tls_security);
 	REG_QUERY_BOOL_VALUE(hKey, _T("RdpSecurity"), dwType, dwValue, dwSize, settings->rdp_security);
@@ -198,10 +203,12 @@ rdpSettings* settings_new(void* instance)
 {
 	rdpSettings* settings;
 
-	settings = (rdpSettings*) xzalloc(sizeof(rdpSettings));
+	settings = (rdpSettings*) malloc(sizeof(rdpSettings));
 
 	if (settings != NULL)
 	{
+		ZeroMemory(settings, sizeof(rdpSettings));
+
 		settings->instance = instance;
 
 		/* Server instances are NULL */
@@ -217,10 +224,13 @@ rdpSettings* settings_new(void* instance)
 		settings->decorations = TRUE;
 		settings->rdp_version = 7;
 		settings->color_depth = 16;
+		settings->ext_security = FALSE;
 		settings->nla_security = TRUE;
 		settings->tls_security = TRUE;
 		settings->rdp_security = TRUE;
 		settings->security_layer_negotiation = TRUE;
+		settings->mstsc_cookie_mode = FALSE;
+		settings->cookie_max_length = DEFAULT_COOKIE_MAX_LENGTH;
 		settings->client_build = 2600;
 		settings->kbd_type = 4; /* @msdn{cc240510} 'IBM enhanced (101- or 102-key) keyboard' */
 		settings->kbd_subtype = 0;
@@ -247,8 +257,10 @@ rdpSettings* settings_new(void* instance)
 
 		settings_get_computer_name(settings);
 
-		settings->received_caps = xzalloc(32);
-		settings->order_support = xzalloc(32);
+		settings->received_caps = malloc(32);
+		settings->order_support = malloc(32);
+		ZeroMemory(settings->received_caps, 32);
+		ZeroMemory(settings->order_support, 32);
 
 		settings->order_support[NEG_DSTBLT_INDEX] = TRUE;
 		settings->order_support[NEG_PATBLT_INDEX] = TRUE;
@@ -273,8 +285,10 @@ rdpSettings* settings_new(void* instance)
 		settings->order_support[NEG_ELLIPSE_SC_INDEX] = TRUE;
 		settings->order_support[NEG_ELLIPSE_CB_INDEX] = TRUE;
 
-		settings->client_hostname = xzalloc(32);
-		settings->client_product_id = xzalloc(32);
+		settings->client_hostname = malloc(32);
+		settings->client_product_id = malloc(32);
+		ZeroMemory(settings->client_hostname, 32);
+		ZeroMemory(settings->client_product_id, 32);
 
 		settings->color_pointer = TRUE;
 		settings->large_pointer = TRUE;
@@ -296,7 +310,7 @@ rdpSettings* settings_new(void* instance)
 		settings->allow_cache_waiting_list = TRUE;
 
 		settings->bitmapCacheV2NumCells = 5;
-		settings->bitmapCacheV2CellInfo = xzalloc(sizeof(BITMAP_CACHE_V2_CELL_INFO) * 6);
+		settings->bitmapCacheV2CellInfo = (BITMAP_CACHE_V2_CELL_INFO*) malloc(sizeof(BITMAP_CACHE_V2_CELL_INFO) * 6);
 		settings->bitmapCacheV2CellInfo[0].numEntries = 600;
 		settings->bitmapCacheV2CellInfo[0].persistent = FALSE;
 		settings->bitmapCacheV2CellInfo[1].numEntries = 600;
@@ -312,8 +326,8 @@ rdpSettings* settings_new(void* instance)
 		settings->suppress_output = TRUE;
 
 		settings->glyphSupportLevel = GLYPH_SUPPORT_FULL;
-		settings->glyphCache = xzalloc(sizeof(GLYPH_CACHE_DEFINITION) * 10);
-		settings->fragCache = xnew(GLYPH_CACHE_DEFINITION);
+		settings->glyphCache = malloc(sizeof(GLYPH_CACHE_DEFINITION) * 10);
+		settings->fragCache = malloc(sizeof(GLYPH_CACHE_DEFINITION));
 		settings->glyphCache[0].cacheEntries = 254;
 		settings->glyphCache[0].cacheMaximumCellSize = 4;
 		settings->glyphCache[1].cacheEntries = 254;
@@ -362,10 +376,13 @@ rdpSettings* settings_new(void* instance)
 		settings->client_hostname[31] = 0;
 		settings->mouse_motion = TRUE;
 
-		settings->client_auto_reconnect_cookie = xnew(ARC_CS_PRIVATE_PACKET);
-		settings->server_auto_reconnect_cookie = xnew(ARC_SC_PRIVATE_PACKET);
+		settings->client_auto_reconnect_cookie = (ARC_CS_PRIVATE_PACKET*) malloc(sizeof(ARC_CS_PRIVATE_PACKET));
+		settings->server_auto_reconnect_cookie = (ARC_SC_PRIVATE_PACKET*) malloc(sizeof(ARC_SC_PRIVATE_PACKET));
+		ZeroMemory(settings->client_auto_reconnect_cookie, sizeof(ARC_CS_PRIVATE_PACKET));
+		ZeroMemory(settings->server_auto_reconnect_cookie, sizeof(ARC_SC_PRIVATE_PACKET));
 
-		settings->client_time_zone = xnew(TIME_ZONE_INFO);
+		settings->client_time_zone = (TIME_ZONE_INFO*) malloc(sizeof(TIME_ZONE_INFO));
+		ZeroMemory(settings->client_time_zone, sizeof(TIME_ZONE_INFO));
 
 		freerdp_detect_paths(settings);
 
diff --git a/libfreerdp/core/tsg.c b/libfreerdp/core/tsg.c
index af04097fc..11d96fffc 100644
--- a/libfreerdp/core/tsg.c
+++ b/libfreerdp/core/tsg.c
@@ -330,7 +330,11 @@ DWORD TsProxySendToServer(handle_t IDL_handle, byte pRpcMessage[], UINT32 count,
 
 	s = stream_new(28 + totalDataBytes);
 
+	printf("TotalDataBytes: %d numBuffers: %d buffer1Length: %d buffer2Length: %d buffer3Length: %d\n",
+			totalDataBytes, numBuffers, buffer1Length, buffer2Length, buffer3Length);
+
 	/* PCHANNEL_CONTEXT_HANDLE_NOSERIALIZE_NR (20 bytes) */
+
 	stream_write_UINT32(s, 0); /* ContextType (4 bytes) */
 	stream_write(s, tsg->ChannelContext, 16); /* ContextUuid (16 bytes) */
 
@@ -354,7 +358,7 @@ DWORD TsProxySendToServer(handle_t IDL_handle, byte pRpcMessage[], UINT32 count,
 	stream_seal(s);
 
 	length = s->size;
-	status = rpc_tsg_write(tsg->rpc, s->data, s->size, 9);
+	status = rpc_tsg_write(tsg->rpc, s->data, s->size, TsProxySendToServerOpnum);
 
 	stream_free(s);
 
diff --git a/libfreerdp/core/tsg.h b/libfreerdp/core/tsg.h
index 34825f7c1..04c49e12e 100644
--- a/libfreerdp/core/tsg.h
+++ b/libfreerdp/core/tsg.h
@@ -4,6 +4,7 @@
  *
  * Copyright 2012 Fujitsu Technology Solutions GmbH
  * Copyright 2012 Dmitrij Jasnov <dmitrij.jasnov@ts.fujitsu.com>
+ * Copyright 2012 Marc-Andre Moreau <marcandre.moreau@gmail.com>
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -59,7 +60,11 @@ typedef WCHAR* RESOURCENAME;
 #define TsProxyAuthorizeTunnelOpnum		2
 #define TsProxyMakeTunnelCallOpnum		3
 #define TsProxyCreateChannelOpnum		4
+#define TsProxyUnused5Opnum			5
+#define TsProxyCloseChannelOpnum		6
+#define TsProxyCloseTunnelOpnum			7
 #define TsProxySetupReceivePipeOpnum		8
+#define TsProxySendToServerOpnum		9
 
 #define MAX_RESOURCE_NAMES			50