Problem with RDP connection

Question

Hi,

Recently, one of the users has a problem with RDP connection to a remote computer. Unfortunately I can't find any information about it. I have sent all the details from the event log. <Event xmlns="__**http://schemas.microsoft.com/win/2004/08/events/event**__">

<System>

  <Provider Name="Microsoft-Windows-TerminalServices-LocalSessionManager" Guid="{5d896912-022d-40aa-a3a8-4fa5515c76d7}" />

  <EventID>36</EventID>

  <Version>0</Version>

  <Level>2</Level>

  <Task>0</Task>

  <Opcode>0</Opcode>

  <Keywords>0x1000000000000000</Keywords>

  <TimeCreated SystemTime="2024-07-03T06:43:03.7594896Z" />

  <EventRecordID>694</EventRecordID>

  <Correlation ActivityID="{61a55000-55e5-1017-0000-000000000000}" />

  <Execution ProcessID="1168" ThreadID="14420" />

  <Channel>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Channel>

  <Computer>PCPIW57</Computer>

  <Security UserID="S-1-5-18" />

  </System>

<EventData>

  <Data Name="SessionId">2</Data>

  <Data Name="State">12</Data>

  <Data Name="StateName">DesktopLocked</Data>

  <Data Name="Event">13</Data>

  <Data Name="EventName">EvDesktopLocked</Data>

  <Data Name="ErrorCode">0x8007139f</Data>

  </EventData>

  </Event>

Answer 1

Hello, 

From the SID, it appears to be a system action.

After checking the event, I couldn't gather enough information. However, I suggest disabling the firewall or Windows Defender and testing again. Keep in mind that turning off the firewall can make your device more vulnerable to unauthorized access.

--- 

If the Answer is helpful, please click "Accept Answer" and upvote it.