Virtual Windows 2012r2 RDS server crashing daily

David Penman
David Penman used Ask the Experts™
Hi All

We are experiencing BSOD crashes within our Windows 2012R2 RDS environment. This is happening most days but is not consistent to 1 RDS server.

Background info:

9 Windows 2012r2 RDS servers in a farm using Microsoft RD Connection Broker
User profiles are UPD's hosted on a solid state SAN

The RDS servers are virtual and are hosted on a 2012r2 HyperV cluster with Failover Cluster Manager and System Center 2012R2 Virtual Machine Manager. All Virtual servers are provided by a Cluster of Dell Equallogic and Compellent SANS

No other VM's are blue screening within the HyperV cluster only the RDS servers which is now almost daily.

Prior to the crash the RDS server logs the following:

The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:


the message resource is present but the message is not found in the string/message table


A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 49.

Other than that the logs don't report much apart from the standard "The previous system shutdown was unexpected"
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Philip ElderTechnical Architect - HA/Compute/Storage

Are the session hosts fully patched?


Hi Philip,

All the physical HyperV hosts are fully patched (Dell PowerEdge R630) and DSET's run across the entire cluster to ensure firmware/ bios and network drivers are up-to date.

The Virtual RDS cluster is also fully patched.

Its a strange issue which almost seems user initiated due to the timings of the BSOD's most crashes happen between 16:00 and 17:00. We have checked all business processes and scheduled tasks etc including backups to ensure nothing is running that would cause the crash.

The daily concurrent session average is 550 - 600 users

All other VM's within this HyperV cluster show no issues.
Philip ElderTechnical Architect - HA/Compute/Storage

What's being used to back up the guests and possibly the hosts?

Is there a backup scheduled to run at 1500 or later?
Is there a Volume Shadow Copy snapshot (Previous Versions) scheduled to run in-guest within 90-120 minutes of that backup?


We use Commvault for backup, all schedules don't start until 18:00. Volume Shadow copies are disabled across all RDS servers.
Philip ElderTechnical Architect - HA/Compute/Storage

Time for some digging in via Process Monitor and Process Explorer.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial