Terminal Service issue

[guest]

One of our clients is running windows 2003 server. Recently they have a problem with Terminal Service. They can't access the server using remote desktop. These are what I did.

1. Make sure Remote Desktop is enabled.

2. We can telnet the server prot 3389. However, can't use RDC to access it.

3. netstat -no doesn't show prt 3389.

4. I changed the port # from 3389 to 2290 using regedit. It was working.

5. Next day, it didn't work agagin. Then I found the termservice in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services was missing and services doesn't have terminal services. So exported it from other server and imported it to the prometical server. it worked again.

6. Next day, it doesn't work. I check every thing, remote desktop is enabled, termservice is running, I can telnet port 3389, I changed the port to 3390, but this time I can't make it work.

I have feeling some software is running using the port 3389, and perhaps makes changes on the system, but what is? Can you help?

[guest]

HelpfulHi Partner,

Thanks for posting here. This is Cedric, and I’m glad to assist you on this thread.

From your description, I understand that the problem you are having is that you are not able to RDP to the termianl server.

Please correct me if the summary of this issue is wrong.

Before moving on, I have a question for you. What’s the error message when you are not able to connect? It is highly appreaciated that you can upload the snapshot of the error message to area provided in the later section.

Please change the RDP listening port back to 3389 and try the following suggestions.

Suggestion:
============
1. Let’s perform a clean boot to exclude third-party issue:
-------------------
a. Click "Start", go to "Run", and type "msconfig" (without the quotation marks) in the open box to start the System Configuration Utility.
b. Click the "Services" tab, check the "Hide All Microsoft Services" box and click "Disable All" (if it is not gray).
c. Click the "Startup" tab, click "Disable All" and click "OK".
d. Click "OK" to restart your computer to Selective Startup environment.
e. When the "System Configuration Utility" window appears, please check the "Don't show this message or launch the System Configuration Utility when Windows starts" box and click OK.

Note: Temporarily disabling the Startup Group only prevents the startup programs from loading at startup. This shouldn't affect the system or other programs. We may still manually run these programs later.

Return from a Clean Boot state
a. Click "Start"->"Run", type "msconfig" (without the quotation marks) and press ENTER.
b. On the "General" tab, click "Normal Startup - load all device drivers and services".
c. Click "OK". Click "Restart" when you are prompted to restart your computer.

Please disable firewall, if firewall is still opened in the clean environment. Afterwards, let’s take a look whether or not the RDP works in the clean mode.

2. Check which program occupy the port 3389. When this issue happen, we could follow the below steps to make further examination:
-------------------
1. On the Terminal Server, click Start , click Run , type cmd , and then click OK .
2. Type the following command, and then press ENTER:

netstat -aon | find ":3389"

You receive results that are similar to the following:

TCP IP_Address : Port IP_Address : Port LISTENING Process_Identifier
Note: The Process_Identifier (ID) that appears in these results is the ID of the process that is listening on port 3389.

3. Right-click the taskbar, and then click Task Manager .
4. Click the Processes tab, and then click Select Columns on the View menu.
5. Click to select the PID (Process Identifier) check box, and then click OK .
6. On the Processes tab, locate the service that corresponds to the process ID that was returned by the netstat command.

[guest]

I have uploaded the log and report.



After I checked more computers, I found most computers, servers and workstation use 2288 port as RDD-tcp port. I think someone might install a software using port 3389. As I mentioned this is my client, I don't know what they did and the IT guy in the company doesn't know that either.



Any way, if I change RDC port to 2288, most computers work fine except the problematic server. I think the problem is we made a lot changes on the server. For example, we import TermServices, RDP-Tcp and TermDD folders from other working server.



The symptoms we have are 1. The server Event Viewer logs ID 50 TermDD. 2. Now I have changed the port to 2288, I can telnet port 228 and TCPView shows svchost is using port 2288, TS is running and remote desktop is enabled. 3. When trying to the server using RDC, we receive "The connection was lost due to network error".



I have tried all suggestion in this page: Case collection of Event ID 50 Source TermDD - http://www.chicagotech.net/troubleshooting/event50.htm

but can’t fix it. I think somehow, the Terminal services have been damaged and need to remove/re-install. But how do you do it?



Also FYI, we have Trend Micro engineer to scan whole network and all computers. He said no virus found.

[guest]

I have not received the files from you. Can you please try to send the files again?

From your description: I found most computers, servers and workstation use 2288 port as RDD-Tcp port, it seems the listening port was unperceivedly changed in wide range of the machine.
I’m wondering if there is a GPO or startup script to change the listening port via modify the register entry.

If possible, please check if there is a startup script like this.

When you have time, please upload the MPS report of the terminal server and network traffic logs to the workspace for further analysis. Meanwhile, let me know the files’ name.

For the error message Termdd 50, I believe the link you provided cover most of cases.

Based on my experience, please check if the patch of KB2160329 was installed on your terminal server . If so, please uninstall it and try once more.

In addition, when you have problem with RDPing to the terminal server, please use a computer which is located in the same subnet of the terminal server to remotely connect to the box.

If the problem still exist, please perform a clean boot both on the testing computer and terminal server, and disable all the FWs and anti-virus programs on both machine, and then try once again.

[guest]

1. Yes, I uploaded dc1.cap and DC1_MpsReports.cab.

2. Yes, we tred to remotely connect to the terminal server from 192.168.1.88 and the connection was failed.

3. I am accessing the server using radmin remotely. I can't not do cross-over cable to connection. That is also the reason I can't do clean boot test.

4. The remote access is just for administrators to manage the DC.

Is there a way to re-install terminal services?

By the way, KB2160329 isn't installed in the server.

[guest]

From your description, I understand you would like to reinstall terminal services.

Please correct me if my understanding is wrong.

Before moving on, I need to confirm one point with you.

The problematic server is just remote administration mode or working as a terminal server?

Please confirm, I will try to find the corresponding method for you.

Bob, is there any message when you failed to RDP to the box? If so, it is highly appreciated that you could send the snapshot of the error message to the following area.

Workspace URL: https://sftus.one.microsoft.com/chooset ... 1dc2a5b018
Password: $df7I56sr)H97huF

[guest]

The error message is "The connection was lost due to network error". This is just remote administration mode.

[guest]

After researching, It seems there is not method to reinstall the component of terminal service.

I take a look the MPS report again and find information below.

01/29/11 15:53:27: ( TermDD ) : The RDP protocol component Device\Termdd detected an error in the protocol stream and has disconnected the client.
01/28/11 21:57:10: ( TermService ) : Terminal Server session creation failed. The relevant status code was 0x2740.

For the first item, please try the following suggestion. (I believe you have already tried this one)

Because of a security error, the client could not connect to the Terminal Server:
http://support.microsoft.com/kb/329896

For the second item, please follow the steps below.

1. On the server, logon to the server locally (not using Remote Desktop/Terminal Client).
2. Click Start, Run, type "tscc.msc /s" (without qutation marks and click OK.
3. In the Terminal Services Configuration snap-in double-click Connections, then RDP-Tcp in the right pane.
4. Click the Network Adapter tab, select the correct network adapter and click OK.
5. Make sure that you can establish an RDP connection to the server.

For details, please refer to the article below.

You can not establish a Remote Desktop session to a computer running one of the affected products.
http://support.microsoft.com/default.as ... -US;555382

In addition, try to install the following hotfixes to update Terminal Server binaries

977629 Terminal Services Group Policies may not take effect in Windows Server 2003 after a terminal server restart
http://support.microsoft.com/default.as ... -US;977629 ->Termsrv.dll

942610 The color depth is unexpectedly changed to 8-bit when a high screen-resolution setting is used in a terminal-server session that is connected to a Windows Server 2003-based computer
http://support.microsoft.com/default.as ... -US;942610 -> RDPWD.SYS

[guest]

Problem:
=================
Not able to RDP to the terminal server.

Assessment:
=================
I take a look the MPS report again and find information below.

01/29/11 15:53:27: ( TermDD ) : The RDP protocol component Device\Termdd detected an error in the protocol stream and has disconnected the client.
01/28/11 21:57:10: ( TermService ) : Terminal Server session creation failed. The relevant status code was 0x2740.

For the first item, please try the following suggestion. (I believe you have already tried this one)

Because of a security error, the client could not connect to the Terminal Server:
http://support.microsoft.com/kb/329896

For the second item, please follow the steps below.

1. On the server, logon to the server locally (not using Remote Desktop/Terminal Client).
2. Click Start, Run, type "tscc.msc /s" (without qutation marks and click OK.
3. In the Terminal Services Configuration snap-in double-click Connections, then RDP-Tcp in the right pane.
4. Click the Network Adapter tab, select the correct network adapter and click OK.
5. Make sure that you can establish an RDP connection to the server.

For details, please refer to the article below.

You cannot establish a Remote Desktop session to a computer running one of the affected products.
http://support.microsoft.com/default.as ... -US;555382

In addition, try to install the following hotfixes to update Terminal Server binaries

977629 Terminal Services Group Policies may not take effect in Windows Server 2003 after a terminal server restart
http://support.microsoft.com/default.as ... -US;977629 ->Termsrv.dll

942610 The color depth is unexpectedly changed to 8-bit when a high screen-resolution setting is used in a terminal-server session that is connected to a Windows Server 2003-based computer
http://support.microsoft.com/default.as ... -US;942610 -> RDPWD.SYS