Event ID 204 — RD Gateway Server Connections
Applies To: Windows Server 2008 R2
.jpg)
For remote clients to successfully connect to internal network resources (computers) through a Remote Desktop Gateway (RD Gateway) server, clients must meet the conditions specified in at least one Remote Desktop connection authorization policy (RD CAP) and Remote Desktop resource authorization policy (RD RAP). RD CAPs specify who can connect to an RD Gateway server and the authentication method that must be used. RD RAPs specify the computers that clients can connect to through an RD Gateway server.
Note: A limit can be set on the RD Gateway server to restrict the maximum number of simultaneous client connections.
Event Details
| Product: | Windows Operating System |
| ID: | 204 |
| Source: | Microsoft-Windows-TerminalServices-Gateway |
| Version: | 6.1 |
| Symbolic Name: | AAG_EVENT_QUARANTINE_FAILED |
| Message: | The user "%1", on client computer "%2", did not meet the requirements of the Network Access Protection (NAP) policies defined in the Network Policy Server. Therefore, the user was not authorized to connect to the RD Gateway server. The following authentication method was attempted: "%3". The following error occurred: "%5". |
Resolve
Ensure that the client meets the health policy requirements configured on the Network Policy Server
To resolve this issue, ensure that the client meets the health policy requirements that are configured on the Network Policy Server (NPS).
Also, consider checking the event log for events that confirm that Network Access Protection (NAP) health policies were successfully applied and that the client met the requirements of the RD CAP. Doing this can help you confirm that the root cause of the problem is the failure for the client to meet NAP health policy requirements, rather than the client failing to meet RD CAP requirements.
Check the health policy requirements for the client
Perform this procedure on the NPS server that is configured to enforce NAP for RD Gateway access (the server where you have configured health policies, connection request policies, and network policies that enforce NAP for RD Gateway). To check health policy requirements, you must check the Windows Security Health Validator (WSHV) that is configured on the NPS server.
To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.
To check the health policy requirements for the client:
- On the NPS server, open the Network Policy Server snap-in console. To open Network Policy Server, click Start, point to Administrative Tools, and then click Network Policy Server.
- In the console tree, expand Network Access Protection, and then click System Health Validators.
- In the details pane, right-click Windows Security Health Validator, and then click Properties.
- In the Windows Security Health Validator Properties dialog box, on the Settings tab, click Configure.
- On the Windows Vista and/or the Windows XP SP2 tab (depending on the operating system that the Remote Desktop Services client is running), note which check boxes are cleared and which check boxes are selected, so that you can check the client configuration and determine whether the client meets the health policy requirements in the WSHV.
- Click OK to close the Windows Security Health Validator Properties dialog box (with the Windows Vista and Windows XP tabs), and then click OK again to close the Windows Security Health Validator Properties dialog box (with the Settings tab).
Check the client configuration to confirm whether the client meets health policy requirements
After you note the health policy requirements configured in the WSHV on the NPS server, check the following settings on the client, and note whether the client configuration meets the requirements configured in the WSHV:
- Whether Windows Firewall is enabled
- Whether an anti-virus application is running and up to date
- Whether an anti-spyware application is running and up to date
- Whether automatic updating is enabled
- Whether client access to internal network resources through RD Gateway is restricted if clients do not have all available security updates installed (and if so, what level of security updates must be installed)
- How often the client must check for new security updates
- Whether clients must receive updates from Windows Server Update Services and Windows Update, in addition to Microsoft Update
If the client settings and WSHV settings are not compatible, do one of the following:
- Modify the client configuration to ensure that the client meets the health policy requirements.
- Modify the settings of the existing WSHV.
For general information about Network Access Protection (NAP) health policies, see Network Access Protection Policies in Windows Server 2008 (https://go.microsoft.com/fwlink/?LinkID=102394).
Search the event log to find relevant NPS events
If you have configured local Remote Desktop connection authorization policies (RD CAPs), perform the following procedure on the RD Gateway server. If you have configured central RD CAPs, perform the following procedure on the NPS server where the central RD CAPs are stored.
To search the event log to find relevant NPS events:
- On the RD Gateway server or the central NPS server, click Start, point to Administrative Tools, and then click Event Viewer.
- Navigate to Windows Logs\Security, and then search for the following additional events that indicate that the client did not meet NAP health policy requirements:
- Event ID 6276, Keyword: Audit Success. This event indicates that the client was denied access to the RD Gateway server and quarantined because the NAP health policy was successfully applied.
- Event ID 6272, Keyword: Audit Success. This event indicates that the RD CAP granted full access to the client. This event is useful for isolating the root cause of the failure for the client to connect to the RD Gateway server. When it is logged in combination with event ID 6276, it indicates that the failure for the client to connect to the RD Gateway server is due to the failure for the client to meet NAP health policy requirements, not the failure of the client to meet RD CAP requirements.
Verify
To verify that RD Gateway server connectivity is working, examine Event Viewer logs and search for the following event messages.
To perform this procedure, you do not need to have membership in the local Administrators group. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.
To verify that RD Gateway server connectivity is working:
- On the RD Gateway server, click Start, point to Administrative Tools, and then click Event Viewer.
- In the Event Viewer console tree, navigate to Application and Services Logs\Microsoft\Windows\TerminalServices-Gateway, and then search for the following events:
- Event ID 101, Source TerminalServices-Gateway: This event indicates that the Remote Desktop Gateway service is running.
- Event ID 200, Source TerminalServices-Gateway: This event indicates that the client is connected to the RD Gateway server.
- Event ID 302, Source TerminalServices-Gateway: This event indicates that the client is connected to an internal network resource through the RD Gateway server.