RDP ClientActiveX Has Been Disconnected
We have a Citrix XenApp 6.5 server (we'll call it Citrix01) running on Server 2008 R2 that is kicking users off their remote desktop connections when connecting through a Citrix Access Gateway server. They get a message saying the Administrator has disconnected your session. This is logged in the event viewer on Citrix01 when it occurs:
Event ID: 1026
Source: TerminalServices-ClientAct
RDP ClientActiveX has been disconnected (Reason=3)
Event ID: 1105
TerminalServices-ClientAct
The multi-transport connection has been disconnected.
I've found lots of other reason codes for this error, however, I'm hoping someone can tell me what Reason 3 is as I have not been able to find it. On the user's computer, the event viewer only lists that the connection was disconnected but does not indicate that is terminated unexpectedly.
If you need anymore information regarding this error or the environment, please reply and I'll get it to you.
Event ID: 1026
Source: TerminalServices-ClientAct
RDP ClientActiveX has been disconnected (Reason=3)
Event ID: 1105
TerminalServices-ClientAct
The multi-transport connection has been disconnected.
I've found lots of other reason codes for this error, however, I'm hoping someone can tell me what Reason 3 is as I have not been able to find it. On the user's computer, the event viewer only lists that the connection was disconnected but does not indicate that is terminated unexpectedly.
If you need anymore information regarding this error or the environment, please reply and I'll get it to you.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I forgot to mention, this is a virtual server (ESXi 5.0). When the users are kicked off, they can reconnect right away, no problem. It happens randomly. One user said it can happen anywhere from 5 minutes to 2 hours after logging in.
Tushar_Darwatkar, I will try uninstalling the update and have the users report back. It may take a few days due to the upcoming holiday, but I will report back if we continue to have issues or not. Thank you for this information.
Tushar_Darwatkar, I will try uninstalling the update and have the users report back. It may take a few days due to the upcoming holiday, but I will report back if we continue to have issues or not. Thank you for this information.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The current NIC type is E1000. I will try a VMXNET3 adapter after testing the uninstalled Windows update as suggested earlier.
Sure no problem.... Waiting to hear from you in this regards... :)
ASKER
Ok, thanks for being patient. I had a user get kicked off today. The previous event is not being logged with the same details, I'm guessing because the update was removed, which provided the information for that event ID. Now it just shows the following events from the Security log:
4648 Logon was attempted
4624 Logon was successful
4634 Account was logged off. Logon type 3. Event is generated when a logon session is destroyed.
It does this twice (two sets of the above messages), and they occur all at the same time (down to the second). However, the Logon IDs listed in each set are different. The user was logged on for approximately 2 hours when they were kicked off and the above was logged.
That's the only thing that strikes me as odd, two sets of successfull log on/log off, but the events were created when they were disconnected. I will be looking into changing the VMNic type during a maintenance period the next few days unless someone has another idea.
4648 Logon was attempted
4624 Logon was successful
4634 Account was logged off. Logon type 3. Event is generated when a logon session is destroyed.
It does this twice (two sets of the above messages), and they occur all at the same time (down to the second). However, the Logon IDs listed in each set are different. The user was logged on for approximately 2 hours when they were kicked off and the above was logged.
That's the only thing that strikes me as odd, two sets of successfull log on/log off, but the events were created when they were disconnected. I will be looking into changing the VMNic type during a maintenance period the next few days unless someone has another idea.
ASKER
Well, I changed the VMNic type and a user still had a disconnect. I'm going to continue to look into and split the points between you two for giving me some ideas at least. Thanks again, I'll continue looking.
Sudeep