Remote Desktop Services isn't starting on an Azure VM

Article
03/27/2024

This article describes how to troubleshoot issues when you connect to an Azure virtual machine (VM) and Remote Desktop Services, or TermService, isn't starting or fails to start.

Symptoms

When you try to connect to a VM, you experience the following scenarios:

The VM screenshot shows the operating system is fully loaded and waiting for credentials.
You remotely view the event logs in the VM by using Event Viewer. You see that Remote Desktop Services, TermService, isn't starting or fails to start. The following log is a sample:

Log Name: System
Source: Service Control Manager
Date: 12/16/2017 11:19:36 AM
Event ID: 7022
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: vm.contoso.com
Description: The Remote Desktop Services service hung on starting.

You can also use the Serial Access Console feature to look for these errors by running the following query:
```
wevtutil qe system /c:1 /f:text /q:"Event[System[Provider[@Name='Service Control Manager'] and EventID=7022 and TimeCreated[timediff(@SystemTime) <= 86400000]]]" | more
```

Cause

This problem occurs because Remote Desktop Services isn't running on the VM. The cause can depend on the following scenarios:

The TermService service is set to Disabled.
The TermService service is crashing or not responding.
The TermService is not starting because of to an incorrect configuration.

Solution

To troubleshoot this issue, use the Serial Console. Or else repair the VM offline by attaching the OS disk of the VM to a recovery VM.

Use Serial Console

Access the Serial Console by selecting Support & Troubleshooting > Serial console. If the feature is enabled on the VM, you can connect the VM successfully.
Create a new channel for a CMD instance. Enter CMD to start the channel and get the channel name.
Switch to the channel that runs the CMD instance. In this case, it should be channel 1:
```
ch -si 1
```
Select Enter again and enter a valid username and password, local or domain ID, for the VM.
Query the status of the TermService service:
```
sc query TermService
```
If the service status shows Stopped, try to start the service:
```
sc start TermService
```
Query the service again to make sure that the service is started successfully:
```
sc query TermService
```

If the service fails to start, follow the solution based on the error you received:

Error	Suggestion
5- ACCESS DENIED	See TermService service is stopped because of an Access Denied error.
1053 - ERROR_SERVICE_REQUEST_TIMEOUT	See TermService service is disabled.
1058 - ERROR_SERVICE_DISABLED	See TermService service crashes or hangs.
1059 - ERROR_CIRCULAR_DEPENDENCY	Contact support to get your issue resolved quickly.
1067 - ERROR_PROCESS_ABORTED	See TermService service crashes or hangs.
1068 - ERROR_SERVICE_DEPENDENCY_FAIL	Contact support to get your issue resolved quickly.
1069 - ERROR_SERVICE_LOGON_FAILED	See TermService service fails because of logon failure
1070 - ERROR_SERVICE_START_HANG	See TermService service crashes or hangs.
1077 - ERROR_SERVICE_NEVER_STARTED	See TermService service is disabled.
1079 - ERROR_DIFERENCE_SERVICE_ACCOUNT	Contact support to get your issue resolved quickly.
1753	Contact support to get your issue resolved quickly.

TermService service is stopped because of an Access Denied problem

Connect to Serial Console and open a PowerShell instance.

Download the Process Monitor tool by running the following script:

remove-module psreadline  
$source = "https://download.sysinternals.com/files/ProcessMonitor.zip" 
$destination = "c:\temp\ProcessMonitor.zip" 
$wc = New-Object System.Net.WebClient 
$wc.DownloadFile($source,$destination)

Now start a procmon trace:

procmon /Quiet /Minimized /BackingFile c:\temp\ProcMonTrace.PML

Reproduce the problem by starting the service that's giving Access Denied:
```
sc start TermService 
```
When it fails, terminate the Process Monitor trace:
```
procmon /Terminate 
```
Collect the file c:\temp\ProcMonTrace.PML:
1. Attach a data disk to the VM.
2. Use Serial Console you can copy the file to the new drive. For example, copy C:\temp\ProcMonTrace.PML F:\. In this command, F is the driver letter of the attached data disk.
3. Detach the data drive and attach it on a working VM that has Process Monitor ubstakke installed.
Open ProcMonTrace.PML by using Process Monitor the working VM. Then filter by Result is ACCESS DENIED, as shown in the following screenshot：
Fix the registry keys, folders, or files that are on the output. Usually, this problem is caused when the sign-in account that's used on the service doesn't have ACL permission to access these objects. To know the correct ACL permission for the sign-in account, you can check on a healthy VM.

TermService service is disabled

Restore the service to its default startup value:
```
sc config TermService start= demand 
```
Start the service:
```
sc start TermService
```
Query its status again to make sure the service is running:
```
sc query TermService 
```
Try to connect to VM by using Remote Desktop.

TermService service fails because of logon failure

This problem occurs if the startup account of this service was changed. Changed this back to its default:
```
sc config TermService obj= 'NT Authority\NetworkService'
```
Start the service:
```
sc start TermService
```
Try to connect to VM by using Remote Desktop.

TermService service crashes or hangs

If the service status is stuck in Starting or Stopping, then try to stop the service:
```
sc stop TermService
```
Isolate the service on its own ‘svchost’ container:
```
sc config TermService type= own
```
Start the service:
```
sc start TermService
```
If the service is still failing to start, Contact support.

Repair the VM offline

Attach the OS disk to a recovery VM

Attach the OS disk to a recovery VM.
Start a Remote Desktop connection to the recovery VM. Make sure that the attached disk is flagged as Online in the Disk Management console. Note the drive letter that's assigned to the attached OS disk.

Open an elevated command prompt instance (Run as administrator). Then run the following script. We assume that the drive letter that's assigned to the attached OS disk is F. Replace it with the appropriate value in your VM.

reg load HKLM\BROKENSYSTEM F:\windows\system32\config\SYSTEM

REM Set default values back on the broken service 
reg add "HKLM\BROKENSYSTEM\ControlSet001\services\TermService" /v start /t REG_DWORD /d 3 /f
reg add "HKLM\BROKENSYSTEM\ControlSet001\services\TermService" /v ObjectName /t REG_SZ /d "NT Authority\NetworkService“ /f
reg add "HKLM\BROKENSYSTEM\ControlSet001\services\TermService" /v type /t REG_DWORD /d 16 /f
reg add "HKLM\BROKENSYSTEM\ControlSet002\services\TermService" /v start /t REG_DWORD /d 3 /f
reg add "HKLM\BROKENSYSTEM\ControlSet002\services\TermService" /v ObjectName /t REG_SZ /d "NT Authority\NetworkService" /f
reg add "HKLM\BROKENSYSTEM\ControlSet002\services\TermService" /v type /t REG_DWORD /d 16 /f

Detach the OS disk and recreate the VM. Then check whether the issue is resolved.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.