Remote Desktop Server Ghost Sessions (4)

Joshua Lance 56

I have just replaced my Windows Server 2016 remote desktop server with 2 Windows Server 2019 high availability remote desktop servers. My previous server was encountering the ghost sessions after the weekly reboot. I implemented the new servers in hopes of resolving this issue.
Unfortunately, today the issue popped up. Rather than displaying the user (4) as disconnected, it indicated (5). I don't think that is significant.
I went through the process to kill the session and the user was able to login.
I am looking for a permanent solution to this issue.
Thanks.

2 answers

Limitless Technology 44,341 Reputation points

2023-06-07T12:23:39.9433333+00:00

Hello there,

Please check Event Viewer on both RDS servers and clients, check to see if there is any relate event that may be helpful to narrow down the problem.

Besides, is there any change before this problem happens?

In general, we would recommended to check/install available Windows Update on both server and client, it may be helpful for resolving some known issues and improving the performance.

Available Updates for Remote Desktop Services in Windows Server 2012 R2:

https://support.microsoft.com/en-us/help/2933664/available-updates-for-remote-desktop-services-in-windows-server-2012-r

Besides, configure appropriate timeout and re-connection may be helpful - Configure Timeout and Reconnection Settings for Remote Desktop Services Sessions:

https://technet.microsoft.com/en-us/library/cc754272(v=ws.11).aspx

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--
Please sign in to rate this answer.
Joshua Lance 56 Reputation points

2023-06-07T15:49:43.42+00:00

ScreenShot.pdfThank you for your response. The servers are Windows Server 2019 and they are running all of the latest updates. They are virtual machines running on a Hyper-V server.
The session timeouts are configured as necessary.
I am not finding anything in the event viewer at the time of the issue. Perhaps there is somewhere else I should be looking?
There were no changes prior to the issue... Other than a reboot of the servers. The issue happened immediately after the reboot.
I then killed the process and the user was able to login.
I am attaching the screenshot that the user sees as well as the task manager screen.

Joshua Lance 56 Reputation points

2023-06-07T15:50:03.5933333+00:00

Capture2.PNGHere is the 2nd screen shot

Joshua Lance 56 Reputation points

2023-06-07T15:50:48.6033333+00:00

Lastly, here is the 3rd screen shot. This is what the user sees.ScreenShot.jpg
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Administrateur 0 Reputation points

2024-04-09T16:16:45.8033333+00:00

Hello Joshua I have the same problem as you every day with Windows Server 2019... have you found a solution?
Please sign in to rate this answer.
Joshua Lance 56 Reputation points

2024-04-09T17:02:07.2166667+00:00

No, I have not found a permanent fix. Fortunately the issue is not very frequent any longer. When I do encounter the issue, this is what I do to kill the session.

-Logon to the Remote Desktop Server where the ghostuser (4) is happening and start taskmgr

-Go to users > expand (4) user proceses en rightclick "Windows logon application" > select "go to details"

-You will go to the winlogon.exe proces in the detail tab for this user. Rightclick winlogon.exe en select "analyze wait chain "

-There you will see a svchost proces with a particular PID. Remember that PID

-Unfortunately, you can't kill the svchost PID with taskmgr. Use Process explorer (sysinternals) and run it as admin. Search for the corresponding svchost PID en kill the process.

Open command prompt as an administrator and enter the command TASKKILL /PID (PID) /F

… Replace PID with the actual PID.

-After that is done the ghostuserlogon will be killed without a reboot

TASKKILL /PID (PID) /F

Administrateur 0 Reputation points

2024-04-09T17:12:08.34+00:00

Thank you Joshua for your quick feedback! it's from microsoft...
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Remote Desktop Server Ghost Sessions (4)

2 answers

Your answer