como puedo encontrar los codigos de motivo del visrto de eventos, ejemplo: La sesión 5367 se ha desconectado. Código de motivo: 2

Question

La sesión 5367 se ha desconectado. Código de motivo: 2

Answer 1

Hello

Thank you for posting in Microsoft Community forum!

The reason codes for events in the Event Viewer can be found in the details of the event logs. Here are some steps you can follow to find the reason codes:

1. Open Event Viewer: Press the Win + R keys to open Run, type eventvwr.msc into Run, and press Enter.
2. In the left pane of Event Viewer, open Windows Logs and System, right-click on System, and click on Filter Current Log....
3. Enter the event ID’s into the <All Event IDs> field, and click OK.

You can review event IDs in the Event Viewer on individual devices. This can help when, for example, a device isn’t appearing in the Devices list. In this scenario, you can look for event IDs on the device and then use the table below to determine further troubleshooting steps based on the corresponding event ID.

For network-related events, you can select Custom views > Server roles > Network Policy and Access Services in Event Viewer. Check for events that have Event ID 6273 or 6274. Most authentication failures produce these events. Check the reason codes of the authentication failure events.

Best Regards,

Wesley Li

Answer 2

hola, lo que necesito es saber que significa el código de motivo, donde puedo encontrar documentación de que es

código de motivo 2, código de motivo 11, código de motivo 53 etc etc.

Answer 3

The meaning of reason codes in Event Viewer can vary depending on the context. Here are some possible interpretations for the reason codes you mentioned:

Reason Code 2: This code is often associated with disconnections initiated by administrative tools. For example, in Remote Desktop Protocol (RDP) sessions, Reason Code 2 is logged when an administrative tool was used to disconnect the session from another session.

Reason Code 11: In the context of RDP sessions, Reason Code 11 is registered when the user disconnecting from the session initiates the disconnection. This might be due to the user shutting the RDP window or to the usage of an administrative tool from the same session, such as the logoff command in CMD or a batch file, to force the disconnect.

Reason Code 53: I couldn’t find a specific interpretation for Reason Code 53 in my search results. The meaning of this code might be specific to the system or application that’s generating it.

For accurate information, I recommend referring to the specific documentation or help resources related to the system you’re using.

Answer 4

ok, ahora tengo 2 dudas más, ¿donde puedo ver los significados de todos los códigos? o esos 4 en listados son todos?

2.-¿como puedo saber que sesión desconecto la sesión es decir, si la sesión 1 desconecto la 2, donde puedo ver eso?

Answer 5

You can find more information about these and other reason codes in the official Microsoft documentation.

As for knowing which session was disconnected, you can check the Event Viewer under Applications and Services Logs => Microsoft => Windows => TerminalServices-LocalSessionManager => Operational. Look for Event ID 24 (disconnected user session). Event ID 25 indicates a reconnect. The details of these events should provide information about which sessions were affected.

System Shutdown Reason Codes (Reason.h) - Win32 apps | Microsoft Learn

Guidance for troubleshooting Network Policy Server - Windows Server | Microsoft Learn

Incorrect shutdown reason code - Windows Server | Microsoft Learn

[e861-5e05-a0e-0c38] (microsoft.com)