Terminal Server crashes

Question

Hi all,

I have to admit, I am a bit desperate regarding this problem.
We have about 30 Users connecting to a terminal server farm with 2 session hosts. The Servers are all 2019 and up to date with the latest patches and updates.

The system is already running since about 2 years without any problems. Now out of the blue the users get disconnected from their sessions and the servers crash about once a week.
As mentioned above we have two session hosts and the connection broker is load balancing the user session. Therefore each day about 15 users are connected to server 1 and the other 15 users are connected to server 2.
The user profile disks are stored on a separate file server.

The problem we are facing is that sometimes server 1 crashes and the users are kicked out of their sessions and sometimes server 2 crashes. There is no real pattern but it happens to both.
I think the problem started with installing the regular September security update. A few days later we got the first crash. However, uninstalling the update didn’t help either.

There is also no real hint and information written to the event log. I already checked everything I could so far. The servers are all HPE Servers and the current SPP with drivers and firmware is installed.

Any help would be greatly appreciated!
Thanks in advance!

Greetings
Aktuator

Answer 1

We have the same exact issue poped from no where in last few months.

RDSH role installed. Users connected and suddently once in a while, everybody gets disconnected and server is in failure.
Most of the times we have to restart the server in order to solve the issue.

No windows events.
No blue screen.

We can't find a clue for that issue.

Answer 2

Hi,

in the meantime we figured out what the problem was.
Actually everything with the servers was fine. The problem was one of the core switches (DELL). After replacing the faulty switch everything went back to normal and stable.

Hope that helps.

Answer 3

Hi there,

bad news.....today the servers crashed again.
Really not sure at the moment what the problem is here. After replacing the core switches, as I wrote above, the problem was gone for about 6-8 weeks.
Question: Which anti virus software do you use? Is it Sophos Intercept X Advanced?

Answer 4

Ok, actually that's good to hear because it confirms my suspicon.
Around the time when we replaced the core switch we also disabled some Sophos features. As I already mentioned, then the problem was gone.
However, about 10 days ago we re-applied the Sophos default security functions and therefore enabled all the Sophos features again and Today most of our users are back from the holidays and therefore the workload/ network utilization is higher than a few days ago....and boom....servers crashed.

Alright, this evening I will disable some of the Sophos features again.
Btw. we are also using User Profile Disks (UPDs). The UPDs are stored on a normal fileserver where Sophos is also installed. Maybe Sophos disconnects the connection between the File Server (UPDs) and RDSH...of course everything will crash then.

Thanks again for your quick reply!

Answer 5

Hi again,

could you please check which version of Sophos Intercept X and Hitman.Pro.Alert you have installed.
I just talked to a Sophos support engineer today and there is a hotfix available which should address the problem