This article helps you understand the most common settings that are used to establish a Remote Desktop session in an enterprise environment, and provides troubleshooting information for Remote desktop disconnected errors.
On the Remote Desktop server, open the Services snap-in. To do thisin, click Start, point to Administrative Tools, and then click Services. If the User Account Control dialog box appears, verify that the action it displays is what you want, and then click Continue. In the Services pane, right-click Remote Desktop Services, and then click Restart. Jul 24, 2019 Remote Desktop disconnected. Because of a security error, the client could not connect to the remote computer. Verify that you are logged onto the network and then try connecting again. When the Remote Desktop client reconnects, the RDSH server reconnects the client to a new session instead of the original session.
Applies to: Windows Server 2012 R2
Original KB number: 2477176
Note
This article is intended for use by support agents and IT professionals.
A Remote Desktop Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server from within a corporate network or from the Internet.
Remote Desktop Session Host (RD Session Host) was formerly known as the Remote Desktop server role service, and Remote Desktop Session Host (RD Session Host) server was formerly known as Remote Desktop server.
Remote Desktop supports two concurrent remote connections to the computer. You do not have to have Remote Desktop Services client access licenses (RDS CALs) for these connections.
To allow more than two administrative connections or multiple user connections, you must install the RD Session Host Role and have appropriate RDS CALs.
When you try to make a Remote Desktop Connection (RDC) to a remote computer or to a Remote Desktop server (Terminal Server) that is running Windows Server 2008 R2, you receive one of the following error messages:
Remote Desktop Disconnected.
This computer can't connect to the remote computer.
Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.
Also, you are limited in the number of users who can connect simultaneously to a Remote Desktop session or Remote Desktop Services session. A limited number of RDP connections can be caused by misconfigured Group Policy or RDP-TCP properties in Remote Desktop Services Configuration. By default, the connection is configured to allow an unlimited number of sessions to connect to the server.
You experience a port assignment conflict. This problem might indicate that another application on the Remote Desktop server is using the same TCP port as the Remote Desktop Protocol (RDP). The default port assigned to RDP is 3389.
After a Remote Desktop server client loses the connection to a Remote Desktop server, you experience one of the following symptoms:
If the client logs back in to the same Remote Desktop server, a new session may be established, and the original session may remain active.
Also, you receive one of the following error messages:
Error message 1
Because of a security error, the client could not connect to the Terminal server. After making sure that you are logged on to the network, try connecting to the server again.
Error message 2
Remote desktop disconnected. Because of a security error, the client could not connect to the remote computer. Verify that you are logged onto the network and then try connecting again.
Remote Desktop Services clients are repeatedly denied access to the Remote Desktop server. If you are using a Remote Desktop Services client to log on to the Remote Desktop server, you may receive one of the following error messages.
Error message 1
Because of a security error, the client could not connect to the Terminal server. After making sure that you are logged on to the network, try connecting to the server again.
Error message 2
Remote desktop disconnected. Because of a security error, the client could not connect to the remote computer. Verify that you are logged onto the network and then try connecting again.
Error message 3
Because of a security error, the client could not connect to the Terminal server. After making sure that you are logged on to the network, try connecting to the server again.
Remote desktop disconnected. Because of a security error, the client could not connect to the remote computer. Verify that you are logged onto the network and then try connecting again.
Additionally, the following event ID messages may be logged in Event Viewer on the Remote Desktop server.
Event message 1
Event message 2
Event message 3
Event message 4
Event message 5
To resolve this problem, use the following methods, as appropriate.
Open the System item in Control Panel. To start the System tool, click Start, click Control Panel, click System, and then click OK.
Under Control Panel Home, click Remote settings.
Click the Remote tab.
Under Remote Desktop, select either of the available options, depending on your security requirements:
Allow connections from computers from computers running any version of Remote Desktop (less secure)
Allow connections from computers only from computers running Remote Desktop with Network Level Authentication (more secure)
If you select Don't allow connections to this computer on the Remote tab, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.
Start the Group Policy snap-in, and then open the Local Security Policy or the appropriate Group Policy.
Locate the following command:
Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections Limit number of connections
Click Enabled.
In the RD Maximum Connections allowed box, type the maximum number of connections that you want to allow, and then click OK.
Follow these steps, depending on your operating system version.
Setting via Remote Desktop Services Configuration
Configure the number of simultaneous remote connections allowed for a connection:
On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services.
Under Connections, right-click the name of the connection, and then click Properties.
On the Network Adapter tab, click Maximum connections, enter the number of simultaneous remote connections that you want to allow for the connection, and then click OK.
If the Maximum connections option is selected and dimmed, the Limit number of connections Group Policy setting has been enabled and has been applied to the RD Session Host server.
Configure the Remote Desktop Users Group.
The Remote Desktop Users group on an RD Session Host server grants users and groups permission to remotely connect to an RD Session Host server. You can add users and groups to the Remote Desktop Users group by using the following tools:
You can use the following procedure to add users and groups to the Remote Desktop Users group by using the Remote tab in the System Properties dialog box on an RD Session Host server.
Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.
Start the System tool. To do this, click Start, click Control Panel, click the System icon, and then click OK.
Under Control Panel Home, click Remote settings.
On the Remote tab in the System Properties dialog box, click Select Users. Add the users or groups that have to connect to the RD Session Host server by using Remote Desktop.
Note
If you select the Don't allow connections to this computer option on the Remote tab, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.
Note
Important
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, seeHow to back up and restore the registry in Windows.
To resolve this problem, determine which application is using the same port as RDP. If the port assignment for that application cannot be changed, change the port assigned to RDP by changing the registry. After you change the registry, you must restart the Remote Desktop Services service. After you restart the Remote Desktop Services service, you should verify that the RDP port has been changed correctly.
The listener component runs on the Remote Desktop server and is responsible for listening for and accepting new Remote Desktop Protocol (RDP) client connections, thereby allowing users to establish new remote sessions on the Remote Desktop server. There is a listener for each Remote Desktop Services connection that exists on the Remote Desktop server. Connections can be created and configured by using the Remote Desktop Services Configuration tool.
To perform these tasks, refer to the following sections.
You can run the netstat tool to determine whether port 3389 (or the assigned RDP port) is being used by another application on the Remote Desktop server:
netstat -a -o
and then press Enter.To determine which application is using port 3389 (or the assigned RDP port), use the tasklist command-line tool along with the PID information from the netstat tool:
tasklist /svc
and then press Enter.You should determine whether this application can use a different port. If you cannot change the application's port, you must change the port that is assigned to RDP.
Important
We recommend that you do not change the port that is assigned to RDP.
If you have to change the port assigned to RDP, you must change the registry. To do this, you must be a member of the local Administrators group, or you must have been granted the appropriate permissions.
To change the port that is assigned to RDP, follow these steps:
On the Remote Desktop server, open Registry Editor. To open Registry Editor, click Start, click Run, type regedit, and then click OK.
If the User Account Control dialog box appears, verify that the action it displays is what you want, and then click Continue.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlRemote Desktop serverWinStations
RDP-TCP is the default connection name. To change the port for a specific connection on the Remote Desktop server, select the connection under the WinStations key:
For the RDP port assignment change to take effect, stop and start the Remote Desktop Services service. To do this, you must be a member of the local Administrators group, or you must have been granted the appropriate permissions.
To stop and start the Remote Desktop Services service, follow these steps:
On the Remote Desktop server, open the Services snap-in. To do this, click Start, point to Administrative Tools, and then click Services.
If the User Account Control dialog box appears, verify that the action it displays is what you want, and then click Continue.
In the Services pane, right-click Remote Desktop Services, and then click Restart.
If you are prompted to restart other services, click Yes.
Verify that the Status column for the Remote Desktop Services service displays a Started status.
To verify that the RDP port assignment has been changed, use the netstat tool:
On the Remote Desktop server, click Start, click Run, type cmd, and then click OK.
At the command prompt, type netstat -a
then press Enter.
Look for an entry for the port number that you assigned to RDP. The port should appear in the list and have a status of Listening.
Important
Remote Desktop Connection and the Terminal server Web Client use port 3389, by default, to connect to a Remote Desktop server. Generac 7550 exl owners manual. If you change the RDP port on the Remote Desktop server, you will have to modify the port used by Remote Desktop Connection and the Remote Desktop server Web Client. For more information, see Change the listening port for Remote Desktop on your computer.
To verify that the listener on the Remote Desktop server is working correctly, use any of the following methods.
Note
RDP-TCP is the default connection name and 3389 is the default RDP port. Use the connection name and port number specific to your Remote Desktop server configuration.
Method 1
Use an RDP client, such as Remote Desktop Connection, to establish a remote connection to the Remote Desktop server.
Method 2
Use the qwinsta tool to view the listener status on the Remote Desktop server:
Method 3
Use the netstat tool to view the listener status on the Remote Desktop server:
netstat -a
then press Enter.Method 4
Use the telnet tool to connect to the RDP port on the Remote Desktop server:
telnet <servername> 3389
, where <servername> is the name of the Remote Desktop server, and then press Enter.If telnet is successful, you receive the telnet screen and a cursor.
If telnet is not successful, you receive the following error message:
Connecting To servername.. Could not open connection to the host, on port 3389: Connect failed
The qwinsta, netstat, and telnet tools are also included in Windows XP and Windows Server 2003. You can also download and use other troubleshooting tools, such as Portqry.
To resolve the issue, configure authentication and encryption.
To configure authentication and encryption for a connection, follow these steps:
On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.
Under Connections, right-click the name of the connection, and then click Properties.
In the Properties dialog box for the connection, on the General tab, in Security layer, select a security method.
In Encryption level, click the level that you want. You can select Low, Client Compatible, High, or FIPS Compliant. See Step 4 above for Windows Server 2003 for Security layer and Encryption level options.
Note
To help troubleshoot this problem, enable CAPI2 event logs on both the client and server computers. This command is shown in the following screenshot.
To work around this problem, follow these steps:
Important
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see 322756 How to back up and restore the registry in Windows.
To resolve this problem, back up and then remove the X509 Certificate registry keys, restart the computer, and then reactivate the Remote Desktop Services Licensing server. To do this, follow these steps.
Note
Perform the following procedure on each of the Remote Desktop servers.
Make sure that the Remote Desktop server registry has been successfully backed up.
Start Registry Editor.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerRCM
On the Registry menu, click Export Registry File.
Type exported- Certificate in the File name box, and then click *Save.
Note
If you have to restore this registry subkey in the future, double-click the Exported-parameters.reg file that you saved in this step.
Right-click each of the following values, click Delete, and then click Yes to verify the deletion:
Exit Registry Editor, and then restart the server.
For more information about Remote Desktop Gateway, see the following articles:
If this article does not help you resolve the problem, or if you experience symptoms that differ from those that are described in this article, visit the Microsoft Support for more information. To search your issue, in the Search support for help box, type the text of the error message that you received, or type a description of the problem.
-->This article explains how to troubleshoot frequent disconnections to an Azure virtual machine (VM) through Remote Desktop Protocol RDP).
You face intermittent RDP connectivity problems during your sessions. You can initially connect to the VM, but then the connection drops.
This problem may occur if the RDP Listener is misconfigured. Typically, this problem occurs on a VM that uses a custom image.
Before you follow these steps, take a snapshot of the OS disk of the affected VM as a backup.
To troubleshoot this issue, use Serial control or repair the VM offline by attaching the OS disk of the VM to a recovery VM.
Connect to Serial Console and open CMD instance. Then, run the following commands to reset the RDP configurations. If the Serial Console is not enabled on your VM, go to the next step.
Lower the RDP Security Layer to 0. At this setting, communications between server and client use the native RDP encryption.
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'SecurityLayer' /t REG_DWORD /d 0 /f
Lower the encryption level to the minimum setting to allow legacy RDP clients to connect.
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'MinEncryptionLevel' /t REG_DWORD /d 1 /f
Set RDP to load the user configuration of the client computer.
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fQueryUserConfigFromLocalMachine' /t REG_DWORD /d 1 /f
Enable the RDP Keep-Alive control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'KeepAliveTimeout' /t REG_DWORD /d 1 /f
REG ADD 'HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'KeepAliveEnable' /t REG_DWORD /d 1 /f
REG ADD 'HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'KeepAliveInterval' /t REG_DWORD /d 1 /f
Set the RDP Reconnect control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fInheritReconnectSame' /t REG_DWORD /d 0 /f
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fReconnectSame' /t REG_DWORD /d 1 /f
REG ADD 'HKLMSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'fDisableAutoReconnect' /t REG_DWORD /d 0 /f
Set the RDP Session Time control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxSessionTime' /t REG_DWORD /d 1 /f
Set the RDP Disconnection Time control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxDisconnectionTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'MaxDisconnectionTime' /t REG_DWORD /d 0 /f
Set the RDP Connection Time control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'MaxConnectionTime' /t REG_DWORD /d 0 /f
Set the RDP Session Idle Time control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxIdleTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'MaxIdleTime' /t REG_DWORD /d 0 /f
Set the 'Limit the maximum concurrent connections' control:
REG ADD 'HKLMSYSTEMCurrentControlSetcontrolTerminal ServerWinstationsRDP-Tcp' /v 'MaxInstanceCount' /t REG_DWORD /d 4294967295 /f
Restart the VM, and try again to connect to it by using RDP.
Attach the OS disk to a recovery VM.
After the OS disk is attached to the recovery VM, make sure that the disk is flagged as Online in the Disk Management console. Note the drive letter that is assigned to the attached OS disk.
On the OS disk that you attached, navigate to the windowssystem32config folder. Copy all the files in this folder as a backup, in case a rollback is required.
Start Registry Editor (regedit.exe).
Select the HKEY_LOCAL_MACHINE key. On the menu, select File > Load Hive:
Browse to the windowssystem32configSYSTEM folder on the OS disk that you attached. For the name of the hive, enter BROKENSYSTEM. The new registry hive is displayed under the HKEY_LOCAL_MACHINE key. Then load the software hive windowssystem32configSOFTWARE under the HKEY_LOCAL_MACHINE key. For the name of the hive software, enter BROKENSOFTWARE.
Open an elevated Command Prompt window (Run as administrator), and run commands in the remaining steps to reset the RDP configurations.
Lower the RDP Security Layer to 0 so that communications between the server and client use the native RDP Encryption:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'SecurityLayer' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'SecurityLayer' /t REG_DWORD /d 0 /f
Lower the encryption level to the minimum setting to allow legacy RDP clients to connect:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'MinEncryptionLevel' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'MinEncryptionLevel' /t REG_DWORD /d 1 /f
Set RDP to load the user configuration of the client machine.
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fQueryUserConfigFromLocalMachine' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fQueryUserConfigFromLocalMachine' /t REG_DWORD /d 1 /f
Enable the RDP Keep-Alive control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'KeepAliveTimeout' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'KeepAliveTimeout' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'KeepAliveEnable' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'KeepAliveInterval' /t REG_DWORD /d 1 /f
Set the RDP Reconnect control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritReconnectSame' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fReconnectSame' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritReconnectSame' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fReconnectSame' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSOFTWAREPoliciesMicrosoftWindows NTTerminal Services' /v 'fDisableAutoReconnect' /t REG_DWORD /d 0 /f
Set the RDP Session Time control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxSessionTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxSessionTime' /t REG_DWORD /d 1 /f
Set the RDP Disconnection Time control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxDisconnectionTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxDisconnectionTime' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxDisconnectionTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxDisconnectionTime' /t REG_DWORD /d 0 /f
Set the RDP Connection Time control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxConnectionTime' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxConnectionTime' /t REG_DWORD /d 0 /f
Set the RDP Session Idle Time control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxIdleTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v ' MaxIdleTime' /t REG_DWORD /d 0 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'fInheritMaxIdleTime' /t REG_DWORD /d 1 /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v ' MaxIdleTime' /t REG_DWORD /d 0 /f
Set the 'Limit the maximum concurrent connections' control:
REG ADD 'HKLMBROKENSYSTEMControlSet001controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxInstanceCount' /t REG_DWORD /d ffffffff /f
REG ADD 'HKLMBROKENSYSTEMControlSet002controlTerminal ServerWinstationsRDP-Tcp' /v 'MaxInstanceCount' /t REG_DWORD /d ffffffff /f
Restart the VM, and try again to connect to it by using RDP.
Contact support. If you still need help, contact support to get your issue resolved quickly.