Link to home
Start Free TrialLog in
Avatar of aando
aando

asked on

Remote Desktop disconnections

I am seeing multiple users get a disconnect and subsequently reconnect to our 2012 R2 Terminal Server. I have not been able to find a pattern in the disconnects as of yet. There is a average of 16 users on the TS at a time. Sometimes a few of them will get a "random" disconnect, sometimes all of them will get a disconnect. Please see below for environment specific info:

--Terminal Server--
Virtualized Hyper-V VM
OS: Server 2012 R2 Standard
Ram: Dynamic (using 34576MB at time of writing)
vCPUS: 8

--Hyper V host--
OS: Server 2012 R2 Standard w/GUI
Ram: 96GB
Proc: 2x x5650's

The TS is has all the RDS roles installed (RDSH, Broker, License, etc). There doesn't seem to be a problem with the license role. The RD license Diagnoser doesn't find anything wrong. The SSL installed is from GoDaddy and I haven't seen any issues regarding that piece either. All client computers are connecting via local RDP client and not using the RDWeb access. I have gathered multiple instances of the following errors when I was notified that all the client workstations were disconnected:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.539110700Z" />
  <EventRecordID>5721</EventRecordID>
  <Correlation ActivityID="{F4206964-70F6-4FC5-8367-D1A0DA9A0000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>89</Session>
  <Reason>0</Reason>
  </EventXML>
  </UserData>
  </Event>

AND

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5D896912-022D-40AA-A3A8-4FA5515C76D7}" />
  <EventID>40</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x1000000000000000</Keywords>
  <TimeCreated SystemTime="2015-06-30T13:42:45.667112400Z" />
  <EventRecordID>5722</EventRecordID>
  <Correlation ActivityID="{F4208B7E-6769-48D9-B172-74A4D4790000}" />
  <Execution ProcessID="1200" ThreadID="48720" />
  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>
  <Computer>remoteTSserver.domain.local</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <UserData>
- <EventXML xmlns="Event_NS">
  <Session>82</Session>
  <Reason>5</Reason>
  </EventXML>
  </UserData>
  </Event>

The short hand are "Session XX has been disconnected, reason code 5" and "Session XX has been disconnected, reason code 0"

I have already removed all "advanced" features form the NIC's on the host server (offloading, etc.) and I am still running into the issue.
Avatar of gheist
gheist
Flag of Belgium image

Any security events surrounding the disconnects?
Avatar of Blue Street Tech
Hi Aando,

This error might be caused by one of the following conditions:
• System resources are inadequate or unavailable.
• The Windows registry is corrupted.
• A service failed to start.
• NIC driver/firmware conflict.
• NCPI Failure.

You can check this article for more info.
Event ID 4005 — Windows Logon Availability
http://technet.microsoft.com/en-us/library/cc734097(v=ws.10).aspx

Additionally, have a look at this article: http://oasysadmin.com/tag/the-windows-logon-process-has-terminated-unexpectedly/.

NIC Related - Update the server NIC drivers and NIC firmware to the latest version recommended by your server manufacturer.  e.g., for Dell download the latest System Update Utility (SUU), burn it to double-layer DVD, and then run it on your server to apply firmware/driver updates/etc.

If updating the server NIC firmware/drivers does not solve the issue I try disabling TCP offload (and potentially other advanced) features on your network adapter and see if the issue is resolved. Sounds like you already did but have a look here: http://support.microsoft.com/kb/951037

After completing the above, please see if updating the NIC driver on a test client PC solves the issue for that PC. If yes, then update all of the PCs that have experienced the problem.

NCPI Failure - Check your NCPI (Network Critical Physical Infrastructure)...bad port/port errors/switch firmware routers/load balancers, etc. that are in the path of the server.

A deeper dive on the systems side: http://blogs.msdn.com/b/rds/archive/2011/01/10/how-to-resolve-the-issue-remote-desktop-disconnected-or-unable-to-connect-to-remote-desktop-terminal-server.aspx

Let me know how it goes!
Avatar of aando
aando

ASKER

I am seeing articles that VMQ could be causing this. Any thoughts on that?
Not getting any logs we can bet on seven dwarfs and three piglets running with scissors as well.
ASKER CERTIFIED SOLUTION
Avatar of aando
aando

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Diagnose cabling first using best tool you have (like gigabit card diag tool that shows cable cut distance OR professional cable tester)
Can you post some of the errors in the firewall and swith?
Avatar of aando

ASKER

It was a Firewall port issue.