0) Disasm %systemroot%\system32\smss.exe file:
   dumpbin smss.exe -disasm > before.txt   
1) Edit %systemroot%\system32\smss.exe file.
2) Find offset of ansi string "\DbgSsApiPort".
3) Find reference to (find the offset) this string in code.
4) "Below" this reference but "above" call to NtCreatePort
   is filled OBJECT_ATTRIBUTES structure.
5) Put NULL to OBJECT_ATTRIBUTES.SecurityDescriptor
   by using the register that contains 0 (and with which are
   initialized other fields: RootDirectory, Attributes and
   SecurityQualityOfService. This is one-byte change.
6) Correct PE checksum - optional.
7) After rebooting only system and administrators can connect
   to \DbgSsApiPort LPC port.