Window 2012 R2 terminal server not showing desktop after logon

Hi Experts,

I am having terminal server running on Windows server 2012R2, it started to kick out a couple of users randomly (and it happened to different users, non-admin accounts), and the affected users can no longer get their desktops back (they could log in but nothing shows on desktop, still can see Windows button but not clickable, right click and Ctrl-Alt-End works), log off and log back in wont help, only reboot the server would solve the issue, but it will come again.

I did check event viewer found some Explorer.EXE errors (see attachments) not sure if that's the culprit, I also ran sfc /scannow but it said some files cant be fixed.

can someone help please!

regards,
Frank
part-of-CBS-log-.txt
2018-02-20-12_24_10-192.168.0.248---.png
LVL 11
manav08Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RaneeshIT SupportCommented:
Have you tried the below option taken from the link, please give a try

 CTRL + ALT + END
- Start Task Manager
- Click processes tab and find all instances of "explorer.exe"
- Right click each process and selected "End process tree"
- Once all instances are gone, select the Applications tab
- Click new task button
- Type "explorer.exe" without the quotation marks
- Click OK.

https://social.technet.microsoft.com/Forums/sharepoint/en-US/49ff177c-66b1-4125-a9bb-a3cb08a69785/windows-server-2008-r2-rdp-blue-screen-no-desktop?forum=winserverTS
0
arnoldCommented:
Echo above comment, possibly corrupt profile.

I.e. Do you use roaming profiles such that logins to the workstations and the server are stored in the same location versus having a dedicated terminal server profile to avoid comingling workstation and seer registry entries...

There are times that somthineg is being processed that delays the desktop.

Often, use NF task manager start explore.exe which should bring your desktop.

I.e. Folder redirection bringing in desktop info....
0
manav08Author Commented:
Hi Raneesh,

it might not be a good option for us, we have around 50 users working on the server at the same time, i cant closed all the instance, actually, under the user session, it showed nothing under process tab, i can restart Exploer.exe under admin account but it didn't help.  i have rebooted the server this morning, it ran smoothly for several hours and happened to another user again earlier.

regards,
Frank
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

manav08Author Commented:
Hi arnold,

we are not using roaming profiles, everyone has a dedicate profile on termimal server.
i doubt it is corrupted profile as it happens to different users randomly, reboot would fix it but it will happen again to other users.

regards,
Frank
0
arnoldCommented:
The explorer.exe needs to be started under the user credentials not admin.

Check event log to see if the system reports a logon event dealing with winlogon, msgina.dll
Does the user to whom this happens already had an active session on the server, in which case check session broker to make sure ..

I.e. UserA logs in.  Does mot logout, but disconnects. The following day, iserA logs in, but the session broker does not connect the user to their already running session and the TS is having an issue with ......accessing the user's profile which is already in use. A temp profike is called for....

Try instead of rebooting, go through terminal server manager, to see and knock the user sessions that complained about the situation.
Enable GPO to kick out/logoff user with idle sessions more than X hours depending on your situation/setup.
0
RaneeshIT SupportCommented:
Hi Frank
And do you feel any malware attack, could you do a complete scan with latest updates scan engine as you said sfc /scannow but it said some files cant be fixed.
0
manav08Author Commented:
Hi arnold,

our TS reboots every morning at 5am.
i will have a check event log about winlogon, msgina.dll and update here.
one of the users reported that he got kicked out of server, when he tried to reconnect he just got nothing on desktop and Windows button not clickable, i remoted in his session and can confirm with that. i checked Task manager at the time found he was logged in but only a dozen process running under his session, not duplicated login tho.

regards,
Frank
0
manav08Author Commented:
HI Raneesh,

i will do a malware scan tonight.
is it safe to run DISM /Online /Cleanup-Image /RestoreHealth on the server? i never ran this cmd on server before, just afraid if it breaks things.
0
RaneeshIT SupportCommented:
First try with malware scan, DSIM I havn't tried with a server yet, but with W10 I tried and it went without issues.
0
arnoldCommented:
see if the pattern persist, the user is either kicked out or the user connection drops and the session disconnects.......
that could be the pattern, the resumption of the prior session is getting stuck ..... and on reconnect this is the situation.

Is the server reboot everyday a requirement as a means to address prior issues?

commonly, a  server should run until an update needs to be applied, etc.
0
manav08Author Commented:
Hi arnold,

yesterday when the issue happened, I logged the user off from admin account, i am sure the user was completely logged off as I checked task manager saw the user is off, and I tried to log in using his credentials from my PC but his desktop wouldn't load properly.

we have a software installed on the server and the vendor required us to reboot it every day to make sure their database is backed up after a fresh reboot. it cant be backed up when a user has the app opened up.
0
manav08Author Commented:
i didnt find any error with winlogon, msgina.dll but i browsed the eventlog and focused on the times users complained, i have attached screenshots here. i can see Exeplorer.exe had error each time the issue happened. is that something i should focus on? how do i fix it?
2018-02-21-12_56_20-192.168.0.248---.png
2018-02-21-12_58_56-192.168.0.248---.png
2018-02-21-13_03_27-192.168.0.248---.png
0
arnoldCommented:
ref: https://social.technet.microsoft.com/Forums/windowsserver/en-US/ca056070-e55f-48ae-a774-69182545c79e/crashing-explorerexe-exception-code-0x80270233?forum=winserver8gen
it seems the profile gets locked/corrupted on the subsequent login when the session was already running .

Do you have the session broker running?
https://cloudblogs.microsoft.com/enterprisemobility/2012/06/27/rd-connection-broker-high-availability-in-windows-server-2012/

see if the management of resumption of a previously remaining active session will be handled more gracefully.

test first.
0
manav08Author Commented:
how do i unlock the profile if thats the case? will logoff unlock it? it is happening right now, im logging in the profie, i have no issue launching programs from Run box, i can also browse and open files if i launch explorer.exe in Run box. just the task bar and empty desktop, also explorer.exe had an error recorded in Eventvwr when then issue happened. i have tried kill explorer.exe for the user but it didnt help.
i dont think it is a corrupted profile? coz it is happens to different users every time, after reboot the problem goes away for a while but it will come  back...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
manav08Author Commented:
it was a Windows update messed everything up, after uninstalling it, all good now. thanks!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Remote Access

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.