Windows Server 2019 RDS - Start & Search does not work, desktops don't load

Question

server 2019 1809 2020-12 updates installed OK, all the way back to March when it was stood up.

Its a RDS server, and I originally configured clients VHDX files to be on a storage server. Very reliable for many months.

First came the complaints about slow log ins, a blank screen for several minutes when people signed in.

then the complaints about the Start menu and Search not working. the left mouse button would not open the Start menu, and users could not enter text in the Search field.

users couldn't figure out how to get to network shares, so I had to create shortcuts on the public desktop.

then the reliability issues. the server would accept connections but the desktop would never render. just a dark blank screen first for several minutes, then then the GUI would never render until the server was powered off and on.

the event viewer start filling up DCOM errors in the system log every time a user signed in. Always about Cortona.

log Name: System

Source: Microsoft-Windows-DistributedCOM

Date: 12/18/2020 2:23:22 PM

Event ID: 10001

Task Category: None

Level: Error

Keywords: Classic

User: domain\user

Computer: server.domain

Unable to start a DCOM Server: Microsoft.Windows.Cortana_1.11.6.17763_neutral_neutral_cw5n1h2txyewy!CortanaUI as Unavailable/Unavailable. The error:

"0"

Happened while starting this command:

"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

<EventID Qualifiers="0">10001</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2020-12-18T20:23:22.975245900Z" />

<EventRecordID>622171</EventRecordID>

<Correlation />

<Execution ProcessID="2128" ThreadID="50464" />

<Channel>System</Channel>

<Computer>RDS.andresmedical.local</Computer>

<Security UserID="S-1-5-21-1177238915-1897051121-725345543-7972" />

</System>

<EventData>

<Data Name="param1">"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca</Data>

<Data Name="param2">0</Data>

<Data Name="param3">Microsoft.Windows.Cortana_1.11.6.17763_neutral_neutral_cw5n1h2txyewy!CortanaUI</Data>

<Data Name="param4">Unavailable</Data>

<Data Name="param5">Unavailable</Data>

</EventData>

</Event>

SFC /scannow found nothing
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth with the source switch said it found issues and fixed them but...

a few days later the server was stuck with blank screens again!

I reset profiles to be stored on the C drive and that was not a fix. Start worked briefly. a few days later the server was stuck with blank screens again!

what started as an annoyance mutated into a big disruption. Seen many posts talking about the broken start but not much success.

if I navigate to C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe and run as admin,

Unable to start a DCOM Server: Microsoft.Windows.Cortana_1.11.6.17763_neutral_neutral_cw5n1h2txyewy!CortanaUI.AppXfbn8w4s0jbk3tjevpcn9kaxerc6rby8k.mca as Unavailable/Unavailable. The error:

"0"
Happened while starting this command:
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
will I have to rebuild from scratch or can this server be saved?

Answer 1

Hi All,

We are seeing the exact same issue as Kenny mentioned above, same version of FSlogix and server 2019. We are in the testing phase, and have not deployed for production as of yet. Application log is filling up with Appmodel-State Warnings - (Various Event ID's 20,21,23,24) all pointing to Microsoft.Windows.Cortana_cw5n1h2txyewy. Some profiles test ok, and do not have this issue as well. Very strange.

Clicking the start menu, or search button also throws Event ID 1000, and ShellExperienceHost.exe or Searchui.exe.

I have seen the above behavior on migrated .v2 profiles to FSLogix vhdx disks. If I let the profile create new in FSlogix, we do not see the error, and all is well.

Pushing Midnight here, so going to turn in for the night. I will try to post more info as I continue testing tomorrow. -Eric

Answer 2

I just came across this same issue on our Windows 2016 RDS Host server we have had running for many years. The reg entries under the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules section and \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\configurable\system were plentyful and yes it took about 1/2 hour to load the entries to the screen and another 20 minutes to delete all of these entries. However, yes it immediately corrected the START MENU and Search menu.... wow. thank you for this.... I also, had the same issue on 2 Windows 10 pc work stations with the same exact issue that this same resolution corrected our 2 Windows 10 pro and Windows 10 Enterprise pc's. So, not sure if this is a Windows bug or update issue....however, the commonality across these machines other than Windows 10/Windows 2016 which, we know are similar OS's. However, all of them were running Symantec Endpoint protection which, overrides the Windows Firewall and maybe this is a Symantec A/V issue?
Are any of you other users, with this issue, running Symantec Corp Endpoint on your servers that could be leaking memory causing these multitude of Firewall rules to be created in the registry or some Symantec A/V updates???
Additional notes.... I deleted all of these entries and refreshed and none of them re-appeared. However, if I log off and log back on again. they start re-appearing again in both registry locations. So, it seems during login these get recreated. So, as a test I have de-installed Symantec, rebooted, re-logged back onto the server and reviewed the registry entries. This then, required the Windows firewall to be turned off since, no RDP rules now existed to connect to the RDP Host session but, of course I had to console into this VMWare server.
However, after removing Symantec, rebooting, deleting registry entries, again, rebooting....they still keep coming back. Even with the firewall OFF and Symantec A/V removed.....

@Björn Braun Resolution definitely so, I did also add the suggested work around of the below to prevent this from happening
Set DWORD "DeleteUserAppContainersOnLogoff = 1
in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy