jared52
asked on
Event ID 50 Source: TermDD every 1-2 hours
Starting Saturday night I have been seeing Event ID 50's Source: TermDD with the description of "The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client" every hour or two on our Terminal Server. When it started it was almost on the hour but is has been as long as 2 hours. No one has contacted me saying they have an issue connecting to the Terminal Server and I have not had an issue either.
Is this something to be concerned about? I can't seem to find anything on the Internet describing my situation, though there are a couple of articles on Microsoft's site about this error, neither description fits my situation.
Is this something to be concerned about? I can't seem to find anything on the Internet describing my situation, though there are a couple of articles on Microsoft's site about this error, neither description fits my situation.
ASKER
Yep, I tried every fix on that page and after each one I still got an error after an hour or so.
What is the cause of the error? Is it the server disconnecting a client or is the server the client that's being disconnected? I guess I am asking if there could be a rogue program that is trying to connect to some other server?
What is the cause of the error? Is it the server disconnecting a client or is the server the client that's being disconnected? I guess I am asking if there could be a rogue program that is trying to connect to some other server?
I don't know what causes it. I wouldn't normally point you to EventID but there seem to be several reasons it can occur. Hopefully someone with personal experience with the error will be along.
--Rob
--Rob
ASKER
I still don't have a solution. None of the websites I've found (EventID.net, Technet, this site, etc.) have a solution for my problem. I can't even find where someone has the same symptoms as me. Any more advise would be appreciated.
I am afraid I am not much help, but glad to "bounce around" some ideas.
Many of the Microsoft articles say; "This error may be logged for clients that disconnected their session correctly". If your users are not complaining, this may be the case, but may be due to an application that is not properly completing its shut down process. If so you may want to try installing the Microsoft User Profile Hive Cleanup Service. It is designed specifically to deal with incomplete logoffs, and is often required on terminal servers:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en
Many of the Microsoft articles say; "This error may be logged for clients that disconnected their session correctly". If your users are not complaining, this may be the case, but may be due to an application that is not properly completing its shut down process. If so you may want to try installing the Microsoft User Profile Hive Cleanup Service. It is designed specifically to deal with incomplete logoffs, and is often required on terminal servers:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en
ASKER
I changed the listening port for the Terminal Server to add a layer of security and since then I have't seen the error. I think it was someone trying to access our system somehow.
Interesting. Let us know if the logs stay "clean".
--Rob
--Rob
ASKER
.Sell, I didn't recieve the error overnight and so it appears it was a malicious attempt to access our server/.
Good to hear it sounds like it was resolved.
I have never been a fan of allowing RDP access without a VPN, but there are seldom problems.
--Rob
I have never been a fan of allowing RDP access without a VPN, but there are seldom problems.
--Rob
ASKER
We are having a more robust hardware firewall installed as soon as I can get my vendor to order it (I'm currently using a Linksys RV042 for gateway/firewall)! I'm new to the server/network admin stuff and this company has never had a fulltime IT person. I'm learning a lot as I go and trying to figure out what to get all worked up about and what not to! In the meantime I have locked down every other port and watching the router logs to see if the new port is discovered until the new firewall is installed.
RV042 is not a bad unit. Having port 3389 open though exposes you to "curious" folks with port scanners as they have instant access to try guessing user names and passwords. Changing the port, as you have done, helps as they do not instantly know what protocol to use.
ASKER
Well, my vendor recommended we go to a Watchguard firewall and have the people who need to use the terminal server come in through an SSL VPN. I'm not familiar with how to use VPN but that's why he's coming in to install it and show me the ropes.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
You get the points for giving me some piece of mind andhelping me work this out.
:-) Thanks jared52.
Cheers !
--Rob
Cheers !
--Rob
http://www.eventid.net/display.asp?eventid=50&eventno=606&source=TermDD&phase=1