We have two Windows Server 2008 R2 terminal servers in a farm. Both are configured identically, and their only job is to run a single RemoteApp application (users do not log in with full interactive sessions). Intermittently two or three times a day, most (but not all) users on SERVER1 are getting disconnected. SERVER2 is unaffected and the timing is inconsistent.
Users are seeing the following error on their computers when they get disconnected:
I am using logoff events in the Security log to benchmark the exact moment of the disconnects. Group policy limits the maximum time for disconnected sessions to 1 minute (the lowest value you can set) so that disconnected sessions do not linger on the server. I can see the Security log showing a large number of logoff events at the exact same second, which means that whatever caused the disconnects happened exactly one minute prior to those.
The trouble is, I do not see any errors in either the System or Application logs that correspond to the disconnects.
In comparing the logs of both servers, the only thing that stands out is that SERVER1 is logging Group Policy warnings throughout the day for various users in the System log:
[Event ID 1128]
The Group Policy Client Side Extension Group Policy Registry may have caused the Group Policy Service to terminate unexpectedly. To prevent further failures in the Group Policy Service, this extension has been temporarily disabled until after the next system restart. Group Policy settings managed by this extension may no longer be enforced until the system is restarted. The vendor of this extension should be contacted if this issue recurs.
It's peculiar because this isn't happening on SERVER2. I don't know if it's relevant because it gets logged frequently and it doesn't correlate to the disconnects.
Any ideas?