Remote Desktop disconnections

I am seeing multiple users get a disconnect and subsequently reconnect to our 2012 R2 Terminal Server. I have not been able to find a pattern in the disconnects as of yet. There is a average of 16 users on the TS at a time. Sometimes a few of them will get a "random" disconnect, sometimes all of them will get a disconnect. Please see below for environment specific info:

--Terminal Server--
Virtualized Hyper-V VM
OS: Server 2012 R2 Standard
Ram: Dynamic (using 34576MB at time of writing)
vCPUS: 8

--Hyper V host--
OS: Server 2012 R2 Standard w/GUI
Ram: 96GB
Proc: 2x x5650's

The TS is has all the RDS roles installed (RDSH, Broker, License, etc). There doesn't seem to be a problem with the license role. The RD license Diagnoser doesn't find anything wrong. The SSL installed is from GoDaddy and I haven't seen any issues regarding that piece either. All client computers are connecting via local RDP client and not using the RDWeb access. I have gathered multiple instances of the following errors when I was notified that all the client workstations were disconnected:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.539110700Z" />
  <EventRecordID>5721</EventRecordID>
  <Correlation ActivityID="{F4206964-70F6-4FC5-8367-D1A0DA9A0000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>89</Session>
  <Reason>0</Reason>
  </EventXML>
  </UserData>
  </Event>

AND

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.667112400Z" />
  <EventRecordID>5722</EventRecordID>
  <Correlation ActivityID="{F4208B7E-6769-48D9-B172-74A4D4790000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>82</Session>
  <Reason>5</Reason>
  </EventXML>
  </UserData>
  </Event>

The short hand are "Session XX has been disconnected, reason code 5" and "Session XX has been disconnected, reason code 0"

I have already removed all "advanced" features form the NIC's on the host server (offloading, etc.) and I am still running into the issue.
aandoAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

gheistCommented:
Any security events surrounding the disconnects?
0
Blue Street TechLast KnightCommented:
Hi Aando,

This error might be caused by one of the following conditions:
• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.
• NIC driver/firmware conflict.
• NCPI Failure.

You can check this article for more info.
Event ID 4005 — Windows Logon Availability
http://technet.microsoft.com/en-us/library/cc734097(v=ws.10).aspx

Additionally, have a look at this article: http://oasysadmin.com/tag/the-windows-logon-process-has-terminated-unexpectedly/.

NIC Related - Update the server NIC drivers and NIC firmware to the latest version recommended by your server manufacturer.  e.g., for Dell download the latest System Update Utility (SUU), burn it to double-layer DVD, and then run it on your server to apply firmware/driver updates/etc.

If updating the server NIC firmware/drivers does not solve the issue I try disabling TCP offload (and potentially other advanced) features on your network adapter and see if the issue is resolved. Sounds like you already did but have a look here: http://support.microsoft.com/kb/951037

After completing the above, please see if updating the NIC driver on a test client PC solves the issue for that PC. If yes, then update all of the PCs that have experienced the problem.

NCPI Failure - Check your NCPI (Network Critical Physical Infrastructure)...bad port/port errors/switch firmware routers/load balancers, etc. that are in the path of the server.

A deeper dive on the systems side: http://blogs.msdn.com/b/rds/archive/2011/01/10/how-to-resolve-the-issue-remote-desktop-disconnected-or-unable-to-connect-to-remote-desktop-terminal-server.aspx

Let me know how it goes!
0
aandoAuthor Commented:
I am seeing articles that VMQ could be causing this. Any thoughts on that?
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

gheistCommented:
Not getting any logs we can bet on seven dwarfs and three piglets running with scissors as well.
1
aandoAuthor Commented:
There are errors on the Firewall and switch ports. I am replacing those and trying to clear that up to see if the issue still persist.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gheistCommented:
Diagnose cabling first using best tool you have (like gigabit card diag tool that shows cable cut distance OR professional cable tester)
0
Blue Street TechLast KnightCommented:
Can you post some of the errors in the firewall and swith?
0
aandoAuthor Commented:
It was a Firewall port issue.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Remote Access

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.