0

After rebooting my work PC (windows XP sp3) this Wednesday (thank to Microsoft Tuesday), I found that I can't remote desktop to my work PC from home (with VPN to company). I have been remote-desktop to work for years and I am really surprised since connectivity is not the problem, so I brought up wireshark to sniff the packets.

I can see after TCP handshake, client sent X.224 Connection Request 03 00 00 13 0e e0 00 00 00 00 00 01 00 08 00 03 00 00 00

server sent X.224 Connection Confirm. 03 00 00 0b 06 d0 00 00 12 34 00

According to "MS-RDPBCGR", the official spec on RDP, the server should include Negotiation Response in the "Connection Confirm" message but it didn't. It's empty.

I googled a lot but didn't find any clue on why server did that.

By the way, I used the same remote desktop client and can connect to other windows XP PC.

Here are a couple of pieces of information that may help to give a clue:

  • Since TCP handshake (server port being 3389), I believe the svchost service is actually running.
  • going to control panel --> system window, ---> "Remote" tab, the remote desktop is indeeded checked and it states that my username is allowed.
  • according to the packet capture, client didn't even get a chance to tell server what user was trying to logon.
  • Yes, the progress bar showed up a few seconds and then it went back to the "Remote desktop Connection" window again.
  • Searched "windowsupdate.log", didn't find any appearance of the word "remote".
sysadmin1138
  • 131,083
  • 18
  • 173
  • 296
Jin
  • 1
  • 1
  • Did you perhaps get removed from the Remote Desktop Users and/or Administrators groups on the problem computer before the reboot? Have you already tried contacting your desktop support provider (if it is not yourself)? – Iszi Feb 04 '11 at 20:33
  • What do you see exactly when the connection fails? Do you see the progress bar for a few seconds in the "Initiating remote connection..." phase and nothing more? – unhappyCrackers1 Feb 04 '11 at 21:34

2 Answers2

1

Problem is fixed.

Here are the things that happened.

I did system restore to the point of before last Tuesday's windows update and it didn't fix the issue.

I noticed in Event viewer the following errors:

Application popup: : \SystemRoot\System32\RDPDD.dll failed to load

and started to google for "RDPDD.dll failed to load" and got a bunch of hints/tips and I changed the following.

  1. upgraded the ATI (display) driver to the latest version and rebooted PC, it didn't help.
  2. through regedit, increased the size of memory management to be 64MB: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management] The problem with remote desktop persists.

Then I thought I may need to reboot PC for the increased memory to take effect. When rebooting, PC gave me a suggestion me to do "install windows update and shutdown", which I took.

I waited for it to finish updating and shutdown and then powered up PC. Now remote desktop is working.

Since there are many variables changed, it's hard to tell which one contributed to the solution. I would guess either increasing memory or redoing the windows update.

Thanks, Jin

Jin
  • 11
  • 1
0

Might be better to take a step back and look at the settings in Windows on your workstation. If Remote registry editing is enabled, you can do the latter in this Technet article from home.

If that looks ok, I'd run netstat -aon | find "3389" and make sure that it's running, and secondly that the process ID in Task Manager is svchost.exe and not some other process.

Finally if you're certain that an update caused it, you can check your windowsupdate.log (start -> run windowsupdate.log) and see if there's any updates that were installed on Tuesday that may be impacting Remote Desktop and Google for their KB ID and "remote desktop".

gravyface
  • 13,947
  • 16
  • 65
  • 100