diff --git a/nmap-service-probes b/nmap-service-probes index 84896796f..bb057afcd 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -13907,9 +13907,10 @@ ports 3388,3389 fallback TerminalServer # varies on flags: -# 0x10 - Remote Credential Guard (Windows 10 1607 or later) # 0x08 - Restricted Admin mode (Windows 8.1 or later) -match ms-wbt-server m|^\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02[\x07\x0f\x1f]\x08\0\x02\0\0\0| p/Microsoft Terminal Services/ o/Windows/ cpe:/o:microsoft:windows/a +# 0x10 - Remote Credential Guard (Windows 10 1607 or later) +# 0x20 - Undocumented; observed on Windows build 10.26100 (Server 2025, Windows 11 24H2) +match ms-wbt-server m|^\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02[\x07\x0f\x17\x1f\x27\x2f\x37\x3f]\x08\0\x02\0\0\0| p/Microsoft Terminal Services/ o/Windows/ cpe:/o:microsoft:windows/a match ms-wbt-server m|^\x03\0\0\x0b\x06\xd0\0\0\x124\0$| p/Microsoft Terminal Services/ o/Windows XP/ cpe:/o:microsoft:windows_xp/a ##############################NEXT PROBE##############################