RDS 2019 Disconnection Codes

Question

I've got users reporting random disconnections and reviewing the TerminalService-LocalSessionManager logs on the session hosts (server 2019) I am seeing disconnection events with the following codes:

2147500036
11
3489660929

I can't seem to find any answers online to what these code's mean.... can anyone help please?

Answer 1

Hello @Hyb.Matt ,

Thanks for your query.

1.Can you show any screenshot for the error message?
2.Reason code 11 (User activity has initiated the disconnect) means that a user has clicked the Disconnect button in the start menu.
Tracking and Analyzing Remote Desktop Activity Logs in Windows: http://woshub.com/rdp-connection-logs-forensics-windows/
3.Session (number of session) has been disconnected, reason code 3489660929:
Create the registry keys necessary to disable the use of UDP for the RDP connection (fclientdisableUDP). Have users test to see if this resolves the issue: https://neilen.com.au/2019/06/10/RDP-UDP-VPN/
Session disconnects: https://www.reddit.com/r/sysadmin/comments/gmlgbl/session_disconnects/
4.Event ID: 226; "Error Code">2147500036
A large number of Inactive Terminal Services ports was detected. This may cause high CPU, slow logon, and failure to map printers and network drives. Please see the referenced blog post for information of how to fix the issue: https://techcommunity.microsoft.com/t5/ask-the-performance-team/performance-issues-due-to-inactive-terminal-server-ports/ba-p/375032
Connection issue Event ID 226: https://social.technet.microsoft.com/Forums/lync/en-US/f10c2433-9cfa-428d-99b9-4fa43be7c3b8/connection-issue-event-id-226?forum=winserverTS

Best regards,
Leila

---

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Leila Kong ,

thanks for the reply.

1. I've attached 2 screenshots for errors 3489660929 and 2147500036.
2. thanks, makes sense so happy I have an answer.
3. I'll get the regkey rolled out and test.
4. hotfix detailed relates to 2008r2 and not 2019. certainly not the port being blocked and there are no issues with logging on to the session hosts.

Answer 3

Hello @Hyb.Matt ,

Thanks for your response.

1.Event ID: 40
Provider Name: Microsoft-Windows-TerminalServices-LocalSessionManager
Description: “Session <X> has been disconnected, reason code <Z>”
Notes: In true Microsoft fashion, although the description is always “Session has been disconnected”, these events also indicate/correlate to reconnections, not just disconnections.
The user disconnected from or reconnected to an RDP session.
Windows RDP-Related Event Logs: Identification, Tracking, and Investigation: https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

2.Event 40. This event is registered whenever a session is disconnected, so that could be an interruption or the user disconnecting or logging off. Within the event text, we are given a reason code, which gives us detail on the disconnection.
Making Sense of RDP Connection Event Logs: https://frsecure.com/blog/rdp-connection-event-logs/