It is in fact the RRAS - I locked myself out of the server by enabling the Firewall and neglecting to update my Plesk license key before it expired. I was in the habit of logging into Plesk to temporarily disable the firewall before remotely accessing the desktop. The solution was to write a small ASP.Net application to impersonate the administrator account and execute a shell command to stop RRAS. Which seemed simple until I read that this is dependant on how the shell command is called because it may or may not be in the context of the impersonated account. Anyway, don't neglect to install new keys before the old ones expire!