1

A Windows server has suddenly stopped accepting remote desktop connections. When I try connecting with MSTSC.EXE it reports An Internal error has occured and with RDCMAN.EXE it reports [Unknown disconnection reason 4].

As, domain admin, I have connected into the server successfully using psexec \\SERVER cmd and I can see that the 'Remote Desktop Services' service is running, and the server is listening on TCP port 3389:

C:\>sc query termservice
SERVICE_NAME: termservice
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0


C:\>netstat -ano | findstr  LISTEN | findstr :3389
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1640
  TCP    [::]:3389              [::]:0                 LISTENING       1640

What can I try, other than rebooting the server?

nwsmith
  • 121
  • 1
  • 1
  • 6
  • Most likely due to this: https://support.microsoft.com/en-us/help/4093492/credssp-updates-for-cve-2018-0886-march-13-2018 – joeqwerty May 09 '18 at 14:56

2 Answers2

0

On the server, run command 'qwinsta` (this is a synonym for QUERY SESSION). Check if the output is as follows:

C:\>qwinsta
 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
>services                                    0  Disc
 console                                     1  Conn
                                         65536  Down

Note that against ID 65536 it says DOWN.

In that case, run the following command, as Administrator.

(if using PSEXEC, see the advice here: "Psexec “run as (remote) admin”)

C:\>reset session 65536
If you reset this session, all users using this protocol will be logged off,
continue (n=no)? y

Now, check with 'qwinsta' again, and it should show ID 65536 as LISTEN.

C:\>qwinsta
 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
>services                                    0  Disc
 console                                     1  Conn
 rdp-tcp                                 65536  Listen

..and then the server should start responding to remote desktop connections.

It may also be worth mentioning, that if you see just this:

C:\>qwinsta
 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
>services                                    0  Disc
 console                                     1  Conn

..then remote connections may well be disabled. Check the registry to confirm:

C:\>reg query "hklm\system\Currentcontrolset\control\terminal server" | findstr DenyTS
    fDenyTSConnections    REG_DWORD    0x1

fDenyTSConnections set to 0x1 indicates 'Remote Desktop disabled' and 0x0 indicates 'Remote Desktop enabled'.

nwsmith
  • 121
  • 1
  • 1
  • 6
0

Your problem might be related to Windows Updates 03-04.2018 (client updated but not the server) check answer here: RDP error "The function requested is not supported" after enabling NLA and this MS info

zexer
  • 1
  • 1