Avatar of aando
aando
 asked on

Remote Desktop disconnections

I am seeing multiple users get a disconnect and subsequently reconnect to our 2012 R2 Terminal Server. I have not been able to find a pattern in the disconnects as of yet. There is a average of 16 users on the TS at a time. Sometimes a few of them will get a "random" disconnect, sometimes all of them will get a disconnect. Please see below for environment specific info:

--Terminal Server--
Virtualized Hyper-V VM
OS: Server 2012 R2 Standard
Ram: Dynamic (using 34576MB at time of writing)
vCPUS: 8

--Hyper V host--
OS: Server 2012 R2 Standard w/GUI
Ram: 96GB
Proc: 2x x5650's

The TS is has all the RDS roles installed (RDSH, Broker, License, etc). There doesn't seem to be a problem with the license role. The RD license Diagnoser doesn't find anything wrong. The SSL installed is from GoDaddy and I haven't seen any issues regarding that piece either. All client computers are connecting via local RDP client and not using the RDWeb access. I have gathered multiple instances of the following errors when I was notified that all the client workstations were disconnected:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.539110700Z" />
  <EventRecordID>5721</EventRecordID>
  <Correlation ActivityID="{F4206964-70F6-4FC5-8367-D1A0DA9A0000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>89</Session>
  <Reason>0</Reason>
  </EventXML>
  </UserData>
  </Event>

AND

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.667112400Z" />
  <EventRecordID>5722</EventRecordID>
  <Correlation ActivityID="{F4208B7E-6769-48D9-B172-74A4D4790000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>82</Session>
  <Reason>5</Reason>
  </EventXML>
  </UserData>
  </Event>

The short hand are "Session XX has been disconnected, reason code 5" and "Session XX has been disconnected, reason code 0"

I have already removed all "advanced" features form the NIC's on the host server (offloading, etc.) and I am still running into the issue.
Remote AccessNetworkingWindows Server 2012Hyper-V

Avatar of undefined
Last Comment
aando

8/22/2022 - Mon
gheist

Any security events surrounding the disconnects?
Blue Street Tech

Hi Aando,

This error might be caused by one of the following conditions:
• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.
• NIC driver/firmware conflict.
• NCPI Failure.

You can check this article for more info.
Event ID 4005 — Windows Logon Availability
http://technet.microsoft.com/en-us/library/cc734097(v=ws.10).aspx

Additionally, have a look at this article: http://oasysadmin.com/tag/the-windows-logon-process-has-terminated-unexpectedly/.

NIC Related - Update the server NIC drivers and NIC firmware to the latest version recommended by your server manufacturer.  e.g., for Dell download the latest System Update Utility (SUU), burn it to double-layer DVD, and then run it on your server to apply firmware/driver updates/etc.

If updating the server NIC firmware/drivers does not solve the issue I try disabling TCP offload (and potentially other advanced) features on your network adapter and see if the issue is resolved. Sounds like you already did but have a look here: http://support.microsoft.com/kb/951037

After completing the above, please see if updating the NIC driver on a test client PC solves the issue for that PC. If yes, then update all of the PCs that have experienced the problem.

NCPI Failure - Check your NCPI (Network Critical Physical Infrastructure)...bad port/port errors/switch firmware routers/load balancers, etc. that are in the path of the server.

A deeper dive on the systems side: http://blogs.msdn.com/b/rds/archive/2011/01/10/how-to-resolve-the-issue-remote-desktop-disconnected-or-unable-to-connect-to-remote-desktop-terminal-server.aspx

Let me know how it goes!
aando

ASKER
I am seeing articles that VMQ could be causing this. Any thoughts on that?
Your help has saved me hundreds of hours of internet surfing.
fblack61
gheist

Not getting any logs we can bet on seven dwarfs and three piglets running with scissors as well.
ASKER CERTIFIED SOLUTION
aando

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
gheist

Diagnose cabling first using best tool you have (like gigabit card diag tool that shows cable cut distance OR professional cable tester)
Blue Street Tech

Can you post some of the errors in the firewall and swith?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
aando

ASKER
It was a Firewall port issue.