RDP to SBS2003 not listening on port 3389

Posted on 2011-04-28
Last Modified: 2013-01-15
A HP Proliant ML350 server running SBS2003 SP2 I have just inherited is not listening on port 3389.

It is operating as file/print/dns/dhcp/email server for a small businnes.

Networking appears to be ok, there are some WMI problems however.

netstat -an | find "3389" finds only
UDP    *:*

netstat -an | find "LISTENING" shows many ports listening

Terminal services service is started (automatic)

regedit shows the HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber value to be 3389

processxp.exe shows the process svchost.exe for the terminal services service but under the TCPIP tab nothing is listed.

The only remote access I have is with VNC, the office is ~1hr drive and the server cannot be restarted without someone being there to press F1 for a BIOS error.

What should my next steps be to figure this out ?
Question by:Julian_Perryer
    LVL 5

    Expert Comment

    Hi Julian

    First thing you should try is to restart the Terminal Services Service.

    Then look for any errors in the event log.

    You could also to a netstat with the service stopped and then again with it started to see if its listening on a different port some how.

    One IT
    LVL 23

    Expert Comment

    I supposed you have already checked the firewall??

    But even if RDP is active you still need someone physically press F1 when reboot.

    Author Comment

    Thanks for the replies -

    Terminal services cannot be stopped - it is not presented as an option.

    By using telnet to connect to port 3389 and getting no response even from itself (which works elsewhere) just supports the theory that the port is not available - hence why netstat doesn't list it.

    If i repeat this on a working RDP server host, the telnet screen presents a flashing cursor.
    LVL 5

    Expert Comment

    Hi Julian
    Was just about to send this to you below but I have since tried it myself and when you restart the service it doesn't start listening on the port. so this has lead me to believe that maybe you have something that is crashing TermServer service and then starting it again.

    In my event viewer upon killing and restarting the service I had Events 7034,7035,7036 messages.
    I would go searching through your SYSTEM Event Log for these messages and see if something is crashing the TermServer service.

    To stop the Terminal Services process you're going to have to find the correct SVCHOST.EXE in the Task Manager and then Kill it.

    To make this easy please open the command prompt and run TASKLIST /SVC find the SVCHOST.EXE that has TERMSERVICE under the services column and make a note of the PID Number.

    Next open Task Manager and to see the PID Column click View, Select Columns, Tick PID, OK.
    Find the SVCHOST.EXE process with the same PID as you noted and end it.

    Now go back to the Services Manager and Restart it, But also do what I said above and make a note of the NETSTAT listening ports with it stopped and started.

    Author Comment

    Sorry for the delay everyone,

    I have killed the svchost.exe that was running Terminal services process, and restarted it - i did indeed get the 7034,7035,7036 event id's

    I also took a copy of the netstat listening ports before and after and have compared them to find no change.

    I have also backed up the rgistry key HKLM\System\ControlSet001\Control\Terminal Server\WinStations\RDP-TCP, killed Terminal Services svchost wrapper, and imported the same from another working machine before starting the TermService service.

    Still no port 3389 in use according to netstat.
    LVL 5

    Expert Comment

    Sorry what I meant was restart your server and then take a look at the event viewer and see if you get the  7034,7035,7036 event id's without killing Terminal Services manually.

    I suspect something is causing it to crash and restart, thats why you see it running but not listening.

    Author Comment

    Following a restart i have a 7035 at 09:48:31 for the terminal services service, 7036 a short while later.

    I've gone through the other events in System log and there is nothing related to Terminal Services, or services stopping/exiting.

    There is nothing in Application log either that looks related.


    Author Comment

    ... netstat -an | find "3389" shows nothing still

    Accepted Solution

    Sorry to resurrect such an old thread -

    Simply reapplying the Service Pack 2 for windows has got it working.

    Previous to that I disabled RRAS and enabled the windows firewall so i could log the ok/failed connections and prove that the request was reaching the machine which it was.

    Thanks for your help with this

    Author Closing Comment

    Solved it myself

    Expert Comment

    in command line:

    Sc queryex termservice


    SERVICE_NAME: termservice
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 4  RUNNING
                                    (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 7388
            FLAGS              :

    Then to forcefully kill the task:

    taskkill /pid 7388 /f

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    A lot of problems and solutions are available on the net for the error message "Source server does not meet minimum requirements for migration" while performing a migration from Small Business Server 2003 to SBS 2008. This error pops up just before …
    In the event you manage a Small Business Server 2003, and you are audited for PCI compliance, there are several changes you must make in order to pass the audit. I can take no credit for discovering any of these fixes or workarounds, but there is no…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now