This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 16%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi all,
I have to admit, I am a bit desperate regarding this problem.
We have about 30 Users connecting to a terminal server farm with 2 session hosts. The Servers are all 2019 and up to date with the latest patches and updates.
The system is already running since about 2 years without any problems. Now out of the blue the users get disconnected from their sessions and the servers crash about once a week.
As mentioned above we have two session hosts and the connection broker is load balancing the user session. Therefore each day about 15 users are connected to server 1 and the other 15 users are connected to server 2.
The user profile disks are stored on a separate file server.
The problem we are facing is that sometimes server 1 crashes and the users are kicked out of their sessions and sometimes server 2 crashes. There is no real pattern but it happens to both.
I think the problem started with installing the regular September security update. A few days later we got the first crash. However, uninstalling the update didn’t help either.
There is also no real hint and information written to the event log. I already checked everything I could so far. The servers are all HPE Servers and the current SPP with drivers and firmware is installed.
Any help would be greatly appreciated!
Thanks in advance!
Greetings
Aktuator
Hi Can1-7470,
yes, it is the same hotfix.
We installed it yesterday and now have to wait and see what happens.
Btw. which OS are you using and are you also using UPDs (User profile disks) ?
Greetings
Aktuator
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 94%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Hi,
It did happen again even after uninstalling the av(sophos).
Are you using smart card utility(eg. ID Protect) on the RDS server?
We saw some a common condition when all of our server with the same issue are using smart card on the server.
Looking forward
Hi,
no, we are not using smart card utilities.
We installed the Sophos hotfix on Monday. So far we didn't have another crash....however, we still need to be patient and monitor the systems. I guess by the end of next week we can be 90% sure that the hotfix solved our problem.
Greetings
Aktuator
Hi,
since we applied the hotfix we had no more server crash. So we can be quite sure the problem is solved.
How is it going on your side?
Hi,
Yes we had some servers that the hotfix really fixed the issue, however for our suprise we saw more servers with no av installed that getting disconnected.
We still have no clue what is causing that. We know it's a memory leak and also microsoft published some known issue in regards of rds disconnection issues.
It is still under investigation.
Let me know if you find anything new.
Thanks.
ahh...shoot...
we had another crash today
Hi,
We sent a memory dump to microsoft for os memory analysis.
Also to VMware a core dump.
Are you using vmware for the virtualization? If yes, could you share your esxi versions(where problem occurs)
Just making sure, the crash happend to you when no av is installed on the machine, right?
As I mentioned earlier, the case in our environment is that sophos av is making the issue to occur more frequetnly but it also happend with no av installed at all.
Therefore av is making it worse.
Let me know, maybe we help each other here.
Hi,
we are using Hyper-V for the virtualization.
Sophos AV was always installed on the servers. We never uninstalled it so we can't say if it also happens without Sophos. However, once we disabled most of the Sophos features, like the new and "fancy" once such as deep learning, Exploit-Defense, Stop Unknown Threats, etc.
So we just used the classic features like file scan, etc. During that time the servers were running 100% stable for about 8 weeks.
Another problem we have is that when the crash happens there is no memory dump created. So there is nothing we can provide to the Sophos or Microsoft support.
The reason why no memory dump is created is propably because there is no real BSOD, it is more like all network connections are disconnected and the server is isolated from the network.
Phew....really a though one