Remote Desktop disconnections

aando
aando used Ask the Experts™
on
I am seeing multiple users get a disconnect and subsequently reconnect to our 2012 R2 Terminal Server. I have not been able to find a pattern in the disconnects as of yet. There is a average of 16 users on the TS at a time. Sometimes a few of them will get a "random" disconnect, sometimes all of them will get a disconnect. Please see below for environment specific info:

--Terminal Server--
Virtualized Hyper-V VM
OS: Server 2012 R2 Standard
Ram: Dynamic (using 34576MB at time of writing)
vCPUS: 8

--Hyper V host--
OS: Server 2012 R2 Standard w/GUI
Ram: 96GB
Proc: 2x x5650's

The TS is has all the RDS roles installed (RDSH, Broker, License, etc). There doesn't seem to be a problem with the license role. The RD license Diagnoser doesn't find anything wrong. The SSL installed is from GoDaddy and I haven't seen any issues regarding that piece either. All client computers are connecting via local RDP client and not using the RDWeb access. I have gathered multiple instances of the following errors when I was notified that all the client workstations were disconnected:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.539110700Z" />
  <EventRecordID>5721</EventRecordID>
  <Correlation ActivityID="{F4206964-70F6-4FC5-8367-D1A0DA9A0000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>89</Session>
  <Reason>0</Reason>
  </EventXML>
  </UserData>
  </Event>

AND

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.667112400Z" />
  <EventRecordID>5722</EventRecordID>
  <Correlation ActivityID="{F4208B7E-6769-48D9-B172-74A4D4790000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>82</Session>
  <Reason>5</Reason>
  </EventXML>
  </UserData>
  </Event>

The short hand are "Session XX has been disconnected, reason code 5" and "Session XX has been disconnected, reason code 0"

I have already removed all "advanced" features form the NIC's on the host server (offloading, etc.) and I am still running into the issue.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2015

Commented:
Any security events surrounding the disconnects?
Blue Street TechLast Knight
Distinguished Expert 2018

Commented:
Hi Aando,

This error might be caused by one of the following conditions:
• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.
• NIC driver/firmware conflict.
• NCPI Failure.

You can check this article for more info.
Event ID 4005 — Windows Logon Availability
http://technet.microsoft.com/en-us/library/cc734097(v=ws.10).aspx

Additionally, have a look at this article: http://oasysadmin.com/tag/the-windows-logon-process-has-terminated-unexpectedly/.

NIC Related - Update the server NIC drivers and NIC firmware to the latest version recommended by your server manufacturer.  e.g., for Dell download the latest System Update Utility (SUU), burn it to double-layer DVD, and then run it on your server to apply firmware/driver updates/etc.

If updating the server NIC firmware/drivers does not solve the issue I try disabling TCP offload (and potentially other advanced) features on your network adapter and see if the issue is resolved. Sounds like you already did but have a look here: http://support.microsoft.com/kb/951037

After completing the above, please see if updating the NIC driver on a test client PC solves the issue for that PC. If yes, then update all of the PCs that have experienced the problem.

NCPI Failure - Check your NCPI (Network Critical Physical Infrastructure)...bad port/port errors/switch firmware routers/load balancers, etc. that are in the path of the server.

A deeper dive on the systems side: http://blogs.msdn.com/b/rds/archive/2011/01/10/how-to-resolve-the-issue-remote-desktop-disconnected-or-unable-to-connect-to-remote-desktop-terminal-server.aspx

Let me know how it goes!

Author

Commented:
I am seeing articles that VMQ could be causing this. Any thoughts on that?
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Top Expert 2015

Commented:
Not getting any logs we can bet on seven dwarfs and three piglets running with scissors as well.
Commented:
There are errors on the Firewall and switch ports. I am replacing those and trying to clear that up to see if the issue still persist.
Top Expert 2015

Commented:
Diagnose cabling first using best tool you have (like gigabit card diag tool that shows cable cut distance OR professional cable tester)
Blue Street TechLast Knight
Distinguished Expert 2018

Commented:
Can you post some of the errors in the firewall and swith?

Author

Commented:
It was a Firewall port issue.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial