Virtual Windows 2012r2 RDS server crashing daily

Hi All

We are experiencing BSOD crashes within our Windows 2012R2 RDS environment. This is happening most days but is not consistent to 1 RDS server.

Background info:

9 Windows 2012r2 RDS servers in a farm using Microsoft RD Connection Broker
User profiles are UPD's hosted on a solid state SAN

The RDS servers are virtual and are hosted on a 2012r2 HyperV cluster with Failover Cluster Manager and System Center 2012R2 Virtual Machine Manager. All Virtual servers are provided by a Cluster of Dell Equallogic and Compellent SANS

No other VM's are blue screening within the HyperV cluster only the RDS servers which is now almost daily.

Prior to the crash the RDS server logs the following:

The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:


the message resource is present but the message is not found in the string/message table


A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 49.

Other than that the logs don't report much apart from the standard "The previous system shutdown was unexpected"
David PenmanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Are the session hosts fully patched?
David PenmanAuthor Commented:
Hi Philip,

All the physical HyperV hosts are fully patched (Dell PowerEdge R630) and DSET's run across the entire cluster to ensure firmware/ bios and network drivers are up-to date.

The Virtual RDS cluster is also fully patched.

Its a strange issue which almost seems user initiated due to the timings of the BSOD's most crashes happen between 16:00 and 17:00. We have checked all business processes and scheduled tasks etc including backups to ensure nothing is running that would cause the crash.

The daily concurrent session average is 550 - 600 users

All other VM's within this HyperV cluster show no issues.
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
What's being used to back up the guests and possibly the hosts?

Is there a backup scheduled to run at 1500 or later?
Is there a Volume Shadow Copy snapshot (Previous Versions) scheduled to run in-guest within 90-120 minutes of that backup?
David PenmanAuthor Commented:
We use Commvault for backup, all schedules don't start until 18:00. Volume Shadow copies are disabled across all RDS servers.
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Time for some digging in via Process Monitor and Process Explorer.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Remote Access

From novice to tech pro — start learning today.