Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

RDP to SBS2003 not listening on port 3389

Posted on 2011-04-28
11
Medium Priority
?
2,156 Views
Last Modified: 2013-01-15
A HP Proliant ML350 server running SBS2003 SP2 I have just inherited is not listening on port 3389.

It is operating as file/print/dns/dhcp/email server for a small businnes.

Networking appears to be ok, there are some WMI problems however.

netstat -an | find "3389" finds only
UDP 0.0.0.0:33891    *:*

netstat -an | find "LISTENING" shows many ports listening

Terminal services service is started (automatic)

regedit shows the HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber value to be 3389

processxp.exe shows the process svchost.exe for the terminal services service but under the TCPIP tab nothing is listed.

The only remote access I have is with VNC, the office is ~1hr drive and the server cannot be restarted without someone being there to press F1 for a BIOS error.

What should my next steps be to figure this out ?
0
Comment
Question by:Julian_Perryer
11 Comments
 
LVL 5

Expert Comment

by:oneitnz
ID: 35481587
Hi Julian

First thing you should try is to restart the Terminal Services Service.

Then look for any errors in the event log.

You could also to a netstat with the service stopped and then again with it started to see if its listening on a different port some how.

Regards
Brett
One IT
www.oneit.co.nz
0
 
LVL 23

Expert Comment

by:ormerodrutter
ID: 35481842
I supposed you have already checked the firewall??

But even if RDP is active you still need someone physically press F1 when reboot.
0
 

Author Comment

by:Julian_Perryer
ID: 35482409
Thanks for the replies -

Terminal services cannot be stopped - it is not presented as an option.

By using telnet to connect to port 3389 and getting no response even from itself (which works elsewhere) just supports the theory that the port is not available - hence why netstat doesn't list it.

If i repeat this on a working RDP server host, the telnet screen presents a flashing cursor.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 5

Expert Comment

by:oneitnz
ID: 35487290
Hi Julian
Was just about to send this to you below but I have since tried it myself and when you restart the service it doesn't start listening on the port. so this has lead me to believe that maybe you have something that is crashing TermServer service and then starting it again.

In my event viewer upon killing and restarting the service I had Events 7034,7035,7036 messages.
I would go searching through your SYSTEM Event Log for these messages and see if something is crashing the TermServer service.

To stop the Terminal Services process you're going to have to find the correct SVCHOST.EXE in the Task Manager and then Kill it.

To make this easy please open the command prompt and run TASKLIST /SVC find the SVCHOST.EXE that has TERMSERVICE under the services column and make a note of the PID Number.

Next open Task Manager and to see the PID Column click View, Select Columns, Tick PID, OK.
Find the SVCHOST.EXE process with the same PID as you noted and end it.

Now go back to the Services Manager and Restart it, But also do what I said above and make a note of the NETSTAT listening ports with it stopped and started.
0
 

Author Comment

by:Julian_Perryer
ID: 35690180
Sorry for the delay everyone,

I have killed the svchost.exe that was running Terminal services process, and restarted it - i did indeed get the 7034,7035,7036 event id's

I also took a copy of the netstat listening ports before and after and have compared them to find no change.

I have also backed up the rgistry key HKLM\System\ControlSet001\Control\Terminal Server\WinStations\RDP-TCP, killed Terminal Services svchost wrapper, and imported the same from another working machine before starting the TermService service.

Still no port 3389 in use according to netstat.
0
 
LVL 5

Expert Comment

by:oneitnz
ID: 35694698
Sorry what I meant was restart your server and then take a look at the event viewer and see if you get the  7034,7035,7036 event id's without killing Terminal Services manually.

I suspect something is causing it to crash and restart, thats why you see it running but not listening.
0
 

Author Comment

by:Julian_Perryer
ID: 35706392
Following a restart i have a 7035 at 09:48:31 for the terminal services service, 7036 a short while later.

I've gone through the other events in System log and there is nothing related to Terminal Services, or services stopping/exiting.

There is nothing in Application log either that looks related.


0
 

Author Comment

by:Julian_Perryer
ID: 35706399
... netstat -an | find "3389" shows nothing still
0
 

Accepted Solution

by:
Julian_Perryer earned 0 total points
ID: 36144451
Sorry to resurrect such an old thread -

Simply reapplying the Service Pack 2 for windows has got it working.

Previous to that I disabled RRAS and enabled the windows firewall so i could log the ok/failed connections and prove that the request was reaching the machine which it was.

Thanks for your help with this
0
 

Author Closing Comment

by:Julian_Perryer
ID: 36171588
Solved it myself
0
 

Expert Comment

by:DyrandSystems
ID: 38780998
in command line:

Sc queryex termservice

Yields:


SERVICE_NAME: termservice
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 7388
        FLAGS              :

Then to forcefully kill the task:

taskkill /pid 7388 /f
0

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The problem of the system drive in SBS 2003 getting full continues to be an issue, even though SBS 2008 and SBS 2011 are both in the market place.  There are several solutions to this, including adding additional drive space or using third party uti…
I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
Integration Management Part 2
Suggested Courses

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question