Terminal Server crashes

Question

Hi all,

I have to admit, I am a bit desperate regarding this problem.
We have about 30 Users connecting to a terminal server farm with 2 session hosts. The Servers are all 2019 and up to date with the latest patches and updates.

The system is already running since about 2 years without any problems. Now out of the blue the users get disconnected from their sessions and the servers crash about once a week.
As mentioned above we have two session hosts and the connection broker is load balancing the user session. Therefore each day about 15 users are connected to server 1 and the other 15 users are connected to server 2.
The user profile disks are stored on a separate file server.

The problem we are facing is that sometimes server 1 crashes and the users are kicked out of their sessions and sometimes server 2 crashes. There is no real pattern but it happens to both.
I think the problem started with installing the regular September security update. A few days later we got the first crash. However, uninstalling the update didn’t help either.

There is also no real hint and information written to the event log. I already checked everything I could so far. The servers are all HPE Servers and the current SPP with drivers and firmware is installed.

Any help would be greatly appreciated!
Thanks in advance!

Greetings
Aktuator

Answer 1

Our issues sounds very similar. We have also random crashes. We use Server 2019 (1809) in a farm with approx 10 session hosts. As hypervisor we use VMware (6.7.0, 15160138 and 6.5.0, 14320405) on DELL Server.
Our Sophos or Bitdefender av makes it definitely worse with deeper scan settings. At the moment we have two av solutions because we migrate completly to Bitdefender. But also without av we have sometimes disconnects.

The most time it helps to restart the termservice. But sometimes we have to reboot the whole crashed machine ...

We get follow error messages:

• The object invoked has disconnected from its clients on logon (VMware console)
• Event ID 1035 and 1036: RD Session Host Server listener stack was down. The relevant status code Only one usage of each socket address (protocol/network address/port) is normally permitted. --> We double checked already a conflict. There is no other program wich might use the same socket/port ...

We had an open Microsoft ticket, but there happend actualy nothing. The support was really bad and not qualified ...

Answer 2

Hi guys,

are there any (good) news from you side? We still have that problem and the servers crash once in a while. It is quite frustrating because there is no pattern, no real hint in the logs and the servers dont create a memory dump. Therefore, it is really hard or even impossible to further analyze what's going on.

Answer 3

Yes, after more than 6 months we found the issue.
It was related to a windows update from Aug-Sep and the redirection of devices from the local endpoints to the rdsh.
Disabling the redirection of devices on rdp using gpo solved the issue for us.

Answer 4

Oh wow, that's good news. We are still struggling with the problem.
Could you please tell me the exact gpo you applied?

Answer 5

Hi,

we will try the out of band updates from microsoft. I found the information last week. We will see if it will helps ...

https://www.bleepingcomputer.com/news/microsoft/emergency-windows-server-update-fixes-remote-desktop-issues/amp/

https://support.microsoft.com/de-de/topic/4-januar-2022-kb5010196-betriebssystem-build-17763-2369-out-of-band-1a7a9a37-b154-4e73-92dc-1a2f65a4c0d1

All the best!

Stefan