Another user connected to the remote computer Windows Issue on Remote

Question

Hello,

We are currently in a very strange case where our users (Windows 20H2) connect via FortiClient to our infrastructure to access their PC remotely via RDP. Here some users have disconnections indicating that another user has logged in with their session.

Settings have been done like this:

Also by regrets we have withdrawn the UDP to be fully.

Even with this we have cuts knowing that these users are the only ones to use their workstation.

Do you have an idea about this ?

Thank you in advance.

Benjamin

Answer 1

Hello Benjamin @Benjamin Grusson-Lacoste

1.Does this happen to all the connections or specific user/group?

2.Desktop OS only supports one RDP connection at a time, be in physically local at the machine or remote session protocol. Is it possible there is an old connection still there, that didn't disconnect correctly?

You could check the Event Viewer Security logs (Windows Logs > Security). It should log when someone/something logs into the computer.
Or
Event Viewer - Applications and Services Logs, Microsoft, Windows, TerminalServices-RemoteConnectionManager, Operational

3.Is it possible that two users are using the same username? or another person is mistakenly logging in.

4.Are they connecting to a VPN first? If so, it maybe be a timeout policy there.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards
Karlie

Answer 2

Hello Karlie,

Thank you for your answer.

1. Only to a specific group actually. 5/6 out of 30 in remote. Strange things actually is that we have same setup for all PCs, Users, VPN configuration. So last impact might due to the internet connection of the user but here you might just get a message saying that RDP drop and attempting to reconnect. Unfortunately, you directly get something that make no sense for me where user has been disconnected by themselves.
2. Good transition actually where user are only in remote. So that where it's hard to understand.
3. Login are unique and known also by user.
4. VPN looks fine from what we have. Moreover timeout disconnection are not occuring at all because VPN stay on the whole time + this situation is not generalized.

Here the Event of the security log. We have indeed a logoff but I'm not sure if it helps. Maybe you have a better picture on this than me.
[38688-event.xml][1]
Thank you in advance for your help.

Best,
Benjamin

Answer 3

Karlie,

I managed to find something that could help on this but in the event log we have like 3 events that correspond to the disconnection and it happens always in the following:

• Event 4624: Logon of the PC it self (Ex: PC105 account name) with logon type = 5 with C:\Windows\System32\services.exe
• Event 4672: Special logon of the System account
• Event 4634: Logon off of the user with logon type = 3

From this link: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634, logon type 3 correspond to a Network title where "A user or computer logged on to this computer from the network." And to me the important element is computer where the computer connects to "itself" and disconnect the user. But still I'm not sure to get why the PC itself need to connect.

Hope I have something relevant that could help you.

Best,
Benjamin

Answer 4

Hi Benjamin@Benjamin Grusson-Lacoste

1. Is the disconnection occurred when the user try to log on or during the remote session ?
2. Is it possible that affected users have installed some third party software cause this problem , like this thread suggest.
3. Under event 4624, can you identify who is logging (Windows user ID) in around the time users are being kicked out.

Administrator can run Enter-PSSession cmd from any pc from worksations to query the issued PC if there's still old connection.

Enter-PSSession

You could also try make below setting:

Keep me posted how it goes.

Thank you and have a great day!

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards
Karlie

Answer 5

Hello Karlie,

Thank you for your feedback.

1. This happens during remote at a random time.
2. User can't install third party software
   Here is the software installed

7-Zip 18.05 (x64)
Adobe Acrobat 8 Professional - English, Français, Deutsch
Adobe Acrobat Reader DC
Belarc Advisor 8.5a
Citrix Receiver 4.12
Dell Command | Update
DesktopControl
ESET Endpoint Antivirus
ESET Management Agent
Google Chrome
Greenshot 1.2.10.6
Intel(R) Management Engine Components
Intel(R) Network Connections Drivers
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Intel(R) Wireless Bluetooth(R)
Intel® PROSet/Wireless Software
Java 8 Update 181
Java 8 Update 181 (64-bit)
Java SE Development Kit 8 Update 181
KeePass Password Safe 2.40
LGT Class E-Banking CH
Logitech Options
MariaDB ODBC Driver
Microsoft 365 Apps for business - en-us
Microsoft Edge
Microsoft Edge Update
Microsoft OneDrive
Microsoft OneDrive
Microsoft Silverlight
Microsoft Teams
Microsoft Teams
Microsoft Update Health Tools
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026
Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
Mozilla Firefox 63.0.3 (x64 en-US)
MySQL Connector/ODBC 5.3
MySQL Workbench 6.3 CE
Notepad++ (32-bit x86)
PuTTY release 0.70 (64-bit)
Realtek Audio COM Components
Realtek High Definition Audio Driver
Rocket.Chat 3.0.2
Skype version 8.63
Teams Machine-Wide Installer
Update for Windows 10 for x64-based Systems (KB4023057)
VLC media player
Windows 10 Update Assistant
WinSCP 5.17.7
Zoom

3. Here on the Users Account, only the user assigned to the PC can loggin

Thank you for your help.

Best,
Benjamin