RDP session disconnects immediatley after logon


Am running SBS 2003 and Windows TS 2003 enviroment behind a hardware firewall with 30 clients.

Have suddenly discovered that after a number of sessions being created to the TS, further connections get to the logon screen, after logon credentials are entered the session immediatley disconnects. This logs a succesfull logon/logoff event in system security eventviewer within a second of each other. The temporary fix is to reboot both servers and quickly log on as many sessions as possible (disconnected sessions can still connect). The number of sessions achieved before this occurs appears to be random eg 15, 8, 17sessions.

Looked at the TS licesne server straight away (was installed on TS). No License servers were listed and i could not find my LServer folder (strange), so i reinstalled the TS License Server and the 30 TS Cals i have on the SBS. After restarting the License server pointing the TS explicitly to the license server and rebooting both servers, no difference. The same issue occurs. No Cals are being issued either.
However, i am not convinced that this is a license issue as no errors occur and some clients are able to log on (i doesnt matter which users log on either).

After trudging through the event logs on both servers i couldnt really find anything that appeared relevant accept these two found on the TS:

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1030
Date:            24/07/2008
Time:            10:52:59 AM
User:            xxxxxxx\\administrator
Computer:      xxxxxxx
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1001
Date:            24/07/2008
Time:            7:45:26 AM
User:            NT AUTHORITY\SYSTEM
Computer:      xxxxxxxx
Windows cannot load wldap32.dll. (Not enough storage is available to process this command. ).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The second event is strange as there is plenty of space available and the virtual memory was set at 50% of 40Gb. Since i have set the page file back to system managed.

Any helpfull response is greatly appreciated!!

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


It could be a issue with your memory utilization...whats the size of RAM??? What all are you running on this SBS server? Does this happen at particular time or with any particular user? Are you using roaming profile?


Be carreful, SBS 2003 don't allow the use of Terminal Server in Application Mode (see http://www.microsoft.com/windowsserver2003/sbs/evaluation/faq/term.mspx & http://support.microsoft.com/kb/828056/en-us)
I have had two Windows 2003 server sites running terminal server that have recently reported the same or similar issue.  Both sites have never had issues before but suddenly users cannot log in and we get various errors in the event log similar to above.  

One of the servers is also experiencing problems logging into the console and directly reporting the "out of storage" on the console screen when you try and log in.

From some basic research I believe the storage referred to in the event does not refer to physical disk storage or even memory but some other resource that has been used up.  Some experts exchange entires refer to this: i.e


I have yet to ascertain the resource being exhausted, the application or service that is chewing up the resource and why the issue just appeared.  

I have a thought it may be associated with an recent Windows update but again cannot be sure.

Maybe together we can nut something out ...

jentc001Author Commented:
Hi Guys,

Thanks for the responses. The sites issues were caused by a trojan virus - TSPY_ZBOT.PF (Trends name). Which explains the freakish random events occuring randomley. Once this was removed, normal operation followed.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.