Server 2019 RDS Winlogon 4005 Blackscreen after 9 sessions

Richard Tomik 26 Reputation points
2022-02-01T13:14:59.84+00:00

Hello,
i have problem with windows 2019 standard that only 9 rds sessions can be created after that next rdp session gets just black screen and disconnect after few seconds. I ihave all the rds licenceses issued to devices. 170185-teamviewer-2022-02-01-14-07-35.png
In event viewer i gent error The Windows logon process has unexpectedly terminated. EVENT ID 4005
Tried unninstalling latest updates installing updates still the same error.
Found here http://www.chicagotech.net/remoteissues/eventid4005.htm the same error accourding to that its problem with rdpcorets.dll. Can it help to copy dll files from other server?

Thanks for help

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,084 questions
Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
4,226 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Richard Tomik 26 Reputation points
    2022-02-01T13:16:37.24+00:00

    C:\Users\Administrator>sfc /scannow

    Beginning system scan. This process will take some time.

    Beginning verification phase of system scan.
    Verification 100% complete.

    Windows Resource Protection found corrupt files but was unable to fix some of them.
    For online repairs, details are included in the CBS log file located at
    windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
    repairs, details are included in the log file provided by the /OFFLOGFILE flag.

    C:\Users\Administrator> 

    2022-02-01 14:15:38, Info                  CSI    000050c9 [SR] Verify complete  
2022-02-01 14:15:38, Info                  CSI    000050ca [SR] Repairing 3 components  
2022-02-01 14:15:38, Info                  CSI    000050cb [SR] Beginning Verify and Repair transaction  
2022-02-01 14:15:38, Info                  CSI    000050cc Hashes for file member [l:23]'tls_branding_config.xml' do not match.  
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.  
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.  
2022-02-01 14:15:38, Info                  CSI    000050cd [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.17763.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch  
2022-02-01 14:15:38, Info                  CSI    000050ce Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.  
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.  
 Actual: {l:32 b:b45d90e43527e118b400d87486820dd8460912fabd1ef147e654b1afc0d4378c}.  
2022-02-01 14:15:38, Info                  CSI    000050cf [SR] Cannot repair member file [l:20]'LServer_PKConfig.xml' of Microsoft-Windows-TerminalServices-LicenseServer-LRWIZDLL, version 10.0.17763.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch  
2022-02-01 14:15:38, Info                  CSI    000050d0@2022/2/1:13:15:38.961 Primitive installers committed for repair  
2022-02-01 14:15:38, Info                  CSI    000050d1 Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.  
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.  
 Actual: {l:32 b:b45d90e43527e118b400d87486820dd8460912fabd1ef147e654b1afc0d4378c}.  
2022-02-01 14:15:38, Info                  CSI    000050d2 [SR] Cannot repair member file [l:20]'LServer_PKConfig.xml' of Microsoft-Windows-TerminalServices-LicenseServer-LRWIZDLL, version 10.0.17763.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch  
2022-02-01 14:15:38, Info                  CSI    000050d3 [SR] This component was referenced by [l:99]'Microsoft-Windows-TerminalServices-Licensing-Package~31bf3856ad364e35~amd64~~10.0.17763.1.Licensing'  
2022-02-01 14:15:38, Info                  CSI    000050d4 [SR] This component was referenced by [l:105]'Microsoft-Windows-TerminalServices-Licensing-UI-Package~31bf3856ad364e35~amd64~~10.0.17763.1.Licensing-UI'  
2022-02-01 14:15:38, Info                  CSI    000050d5 Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.  
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.  
 Actual: {l:32 b:b45d90e43527e118b400d87486820dd8460912fabd1ef147e654b1afc0d4378c}.  
2022-02-01 14:15:38, Info                  CSI    000050d6 Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.  
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.  
 Actual: {l:32 b:b45d90e43527e118b400d87486820dd8460912fabd1ef147e654b1afc0d4378c}.  
2022-02-01 14:15:38, Info                  CSI    000050d7 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\LServer_PKConfig.xml; source file in store is also corrupted  
2022-02-01 14:15:38, Info                  CSI    000050d8@2022/2/1:13:15:38.976 Primitive installers committed for repair  
2022-02-01 14:15:38, Info                  CSI    000050d9 Hashes for file member [l:11]'prncnfg.vbs' do not match.  
 Expected: {l:32 ml:4096 b:9d1b5c38ee56b25bdeedc15d9b5007d864ecc5e55da039a15dbbc3446bae5ec8}.  
 Actual: {l:32 b:b4b7f1af501bd5dfa683b851c59f212be03dcaa5c7d3ce117a9eaacf5b2f1f6a}.  
2022-02-01 14:15:38, Info                  CSI    000050da [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prncnfg.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050db Hashes for file member [l:11]'prndrvr.vbs' do not match.  
 Expected: {l:32 ml:4096 b:929bf6e577ab7892b9c7ffc12c71f5e4dc296518f2e8f8b3dd96610154d58b02}.  
 Actual: {l:32 b:58522b87a835dca79544babeb87f15de6902649c7920bbd89a599cfbfe5ce9ad}.  
2022-02-01 14:15:38, Info                  CSI    000050dc [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prndrvr.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050dd Hashes for file member [l:11]'prnjobs.vbs' do not match.  
 Expected: {l:32 ml:4096 b:dcfeb0da76aef2e6419c03aa6ea0ee687f82becca14cb295a9632d9e1a074dea}.  
 Actual: {l:32 b:5b86e75b395bac294e0d9f8675e75404fb229b78b0e28e0d1adad218c7a9a7ab}.  
2022-02-01 14:15:38, Info                  CSI    000050de [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prnjobs.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050df Hashes for file member [l:11]'prnmngr.vbs' do not match.  
 Expected: {l:32 ml:4096 b:b61c66238568e5ab62232952c710b25c6923dce83300ddb602e17c121da697e1}.  
 Actual: {l:32 b:379e84083c54bc118ad55066b42992d419ff1eb1cbd2d9cd31afc4ef7c446d9c}.  
2022-02-01 14:15:38, Info                  CSI    000050e0 [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prnmngr.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050e1 Hashes for file member [l:11]'prnport.vbs' do not match.  
 Expected: {l:32 ml:4096 b:00b01766e48db0b29480feaa954493cfb5ad12b040d3a113845df56ef8ca82a2}.  
 Actual: {l:32 b:a51032c3a3e6092e7c43af80bc934302907adcfa3fdbc3e6d149fa008f53ac1d}.  
2022-02-01 14:15:38, Info                  CSI    000050e2 [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prnport.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050e3 Hashes for file member [l:11]'prnqctl.vbs' do not match.  
 Expected: {l:32 ml:4096 b:0cd7f097b16fde8c315acac361a2b1f5cc31d8067b22ca7383b24d1417062fc2}.  
 Actual: {l:32 b:5f3d7cf2aa00defd113c728a4aa1d4c76f96cb01297147440fca5c4a7b282634}.  
2022-02-01 14:15:38, Info                  CSI    000050e4 [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\prnqctl.vbs from store  
2022-02-01 14:15:38, Info                  CSI    000050e5 Hashes for file member [l:10]'pubprn.vbs' do not match.  
 Expected: {l:32 ml:4096 b:88e452b57b8c28df15a892c5e52ae43dcd7d7530e5c07838e3b963fa1790ddc3}.  
 Actual: {l:32 b:4ea9df467961cb8238978813e1aa49636f87b7a36ad0e8243eb44d45aad79b7c}.  
2022-02-01 14:15:38, Info                  CSI    000050e6 [SR] Repairing corrupted file \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US\\pubprn.vbs from store  
2022-02-01 14:15:39, Info                  CSI    000050e7 Error: Overlap: Duplicate ownership for file pubprn.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050e8 Error: Overlap: Duplicate ownership for file prndrvr.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050e9 Error: Overlap: Duplicate ownership for file prnjobs.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050ea Error: Overlap: Duplicate ownership for file prnmngr.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050eb Error: Overlap: Duplicate ownership for file prncnfg.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050ec Error: Overlap: Duplicate ownership for file prnport.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050ed Error: Overlap: Duplicate ownership for file prnqctl.vbs in \??\C:\WINDOWS\SysWOW64\Printing_Admin_Scripts\en-US  
    Existing component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.1, arch Host= amd64 Guest= x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
    New component: Microsoft-Windows-Printing-AdminScripts.Resources, version 10.0.17763.107, arch x86, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}  
2022-02-01 14:15:39, Info                  CSI    000050ee@2022/2/1:13:15:39.030 Primitive installers committed for repair  
2022-02-01 14:15:39, Info                  CSI    000050ef@2022/2/1:13:15:39.032 Primitive installers committed for repair  
2022-02-01 14:15:39, Info                  CSI    000050f0 Hashes for file member [l:23]'tls_branding_config.xml' do not match.  
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.  
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.  
2022-02-01 14:15:39, Info                  CSI    000050f1 [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.17763.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch  
2022-02-01 14:15:39, Info                  CSI    000050f2 [SR] This component was referenced by [l:136]'Microsoft-Windows-Server-Gui-Mgmt-Package-termsrv~31bf3856ad364e35~amd64~~10.0.17763.1.Microsoft-Windows-Server-Gui-Mgmt-Package-termsrv'  
2022-02-01 14:15:39, Info                  CSI    000050f3 [SR] This component was referenced by [l:99]'Microsoft-Windows-TerminalServices-Licensing-Package~31bf3856ad364e35~amd64~~10.0.17763.1.Licensing'  
2022-02-01 14:15:39, Info                  CSI    000050f4 [SR] This component was referenced by [l:126]'Microsoft-Windows-TerminalServices-AppServer-Opt-Package~31bf3856ad364e35~amd64~~10.0.17763.1.9b6e5ada60daa083ef5e29303e58e5d3'  
2022-02-01 14:15:39, Info                  CSI    000050f5 [SR] This component was referenced by [l:105]'Microsoft-Windows-TerminalServices-Licensing-UI-Package~31bf3856ad364e35~amd64~~10.0.17763.1.Licensing-UI'  
2022-02-01 14:15:39, Info                  CSI    000050f6 Hashes for file member [l:23]'tls_branding_config.xml' do not match.  
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.  
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.  
2022-02-01 14:15:39, Info                  CSI    000050f7 Hashes for file member [l:23]'tls_branding_config.xml' do not match.  
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.  
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.  
2022-02-01 14:15:39, Info                  CSI    000050f8 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\tls_branding_config.xml; source file in store is also corrupted  
2022-02-01 14:15:39, Info                  CSI    000050f9@2022/2/1:13:15:39.042 Primitive installers committed for repair  
2022-02-01 14:15:39, Info                  CSI    000050fa [SR] Repair complete  
2022-02-01 14:15:39, Info                  CSI    000050fb [SR] Committing transaction  
2022-02-01 14:15:39, Info                  CSI    000050fc Creating NT transaction (seq 1)  
2022-02-01 14:15:39, Info                  CSI    000050fd Created NT transaction (seq 1) result 0x00000000, handle @0x166c  
2022-02-01 14:15:39, Info                  CSI    000050fe@2022/2/1:13:15:39.095 Beginning NT transaction commit...  
2022-02-01 14:15:39, Info                  CSI    000050ff@2022/2/1:13:15:39.104 CSI perf trace:  
CSIPERF:TXCOMMIT;8862  
2022-02-01 14:15:39, Info                  CSI    00005100 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired
    0 comments
  2. Limitless Technology 39,336 Reputation points
    2022-02-02T10:51:29.947+00:00

    Hello RichardTomik

    There are some suggestions:

    (If you want to do any change for your registry, please full backup your registry of problematical server first.)

    1.Some issues are related device0 registry key missing.
    Please check below registry key is existed on problematical server.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPUDD\Device0
    "InstalledDisplayDrivers"=RDPUDD or other value hex(7):52,00,44,00,50,00,55,00,44,00,44,00,00,00,00,00
    "VgaCompatible"=dword:00000000
    "Device Description"="RDPUDD Chained DD"

    additionally, in some cases the above registry location not corrupted then check the following : Check if value exist under HKLM\System\CurrentControlSet\Control\Terminal Server\VIDEO\RDPUDD\Device\Video0 (we can compare with working server, and non-working server)

    2.Some issues be resolved by deleting the HKLM\System\CurrentControlSet\Enum\TERMINPUT_BUS\UMB\ key on problematical server.

    3.Reduce rediected devices to problematical RD session host server then check result

    4.Reduce firewall rules then check result
    Windows Servr 2016 RDSH - Firewall rules created at every login
    https://social.technet.microsoft.com/Forums/en-US/992e86c8-2bee-4951-9461-e3d7710288e9/windows-servr-2016-rdsh-firewall-rules-created-at-every-login?forum=winserverTS

    5.Check if the issue happen on new created domain user (or test domain user)?
    if the issue also happen on new created domain user (or test domain user), we can don't use UPD or roaming profile or Fslogix for the new domain user account (or test domain user). then monitor some time and check the result.

    6.We can build a new test collection and add the same OS clean installed RDsession host server in it, logon both normal RDSH server and problematical RDSH server by using local admin account in console session, then run procmon on both normal RDSH server and problematical RDSH server respectively in local admin console session, and waiting issue the same issue user account to remote logon normal RDSH server and problematical RDSH server respectively.
    then capture both normal procmon log and problematical procmon log then save all events.
    Finally, we can compare both normal procmon log and problematical procmon log.
    Process Monitor v3.70
    https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments
  3. Richard Tomik 26 Reputation points
    2022-02-03T07:38:28.253+00:00

    Hello thanks for reply ive checked the registry keys that you posted and they seems to be fine with working server but i cant delete umb key170868-teamviewer-2022-02-03-08-32-42.png

    170838-teamviewer-2022-02-03-08-36-49.png

    0 comments
  4. Richard Tomik 26 Reputation points
    2022-03-01T12:37:50.887+00:00

    Hello i reinstalled this server but have same issue with another windows server. What could cause it?