Hi all. I have a 2019 Standard server running RDS. This is a fairly new build and appears to be up to date patch wise. I'm having users periodically report retrying connections (black window with the retrying 1 of 20 box). Sometimes, instead of reconnecting,
we are asked to log back in (full on Other user, enter user and pass). There are a total of 7 users that remote into this VM and it's been reported/experienced by all (myself included).
It's happened twice in the last 15 minutes or so and the first one was a winlogon.exe crash, the other was svchost... with module rdpnano.dll. I'll paste the appropriate event logs below. I only found one other post about this (specifically rdpnano.dll) on
this forum and the OP never replied, so I started this thread. Would like help ironing this out.
This is the svchost error. (App log - Event ID 1000)
Log Name: Application Source: Application Error Date: 4/27/2020 5:54:46 PM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: RDS-2019-2.domainname Description: Faulting application name: svchost.exe_TermService, version: 10.0.17763.1, time stamp: 0xb900eeff Faulting module name: rdpnano.dll, version: 1.0.1910.10003, time stamp: 0x5d9fb8b3 Exception code: 0xc0000005 Fault offset: 0x000000000007a054 Faulting process id: 0x6040 Faulting application start time: 0x01d61ab86b84bf5e Faulting application path: C:\Windows\System32\svchost.exe Faulting module path: C:\Windows\System32\rdpnano.dll Report Id: 0b81271a-d9b4-4089-8baa-47f966b54eb1 Faulting package full name: Faulting package-relative application ID: Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Application Error" /><EventID Qualifiers="0">1000</EventID><Level>2</Level><Task>100</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2020-04-27T21:54:46.409850400Z" /><EventRecordID>97942</EventRecordID><Channel>Application</Channel><Computer>RDS-2019-2.domainname</Computer><Security /></System><EventData><Data>svchost.exe_TermService</Data><Data>10.0.17763.1</Data><Data>b900eeff</Data><Data>rdpnano.dll</Data><Data>1.0.1910.10003</Data><Data>5d9fb8b3</Data><Data>c0000005</Data><Data>000000000007a054</Data><Data>6040</Data><Data>01d61ab86b84bf5e</Data><Data>C:\Windows\System32\svchost.exe</Data><Data>C:\Windows\System32\rdpnano.dll</Data><Data>0b81271a-d9b4-4089-8baa-47f966b54eb1</Data><Data></Data><Data></Data></EventData></Event>
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 4/27/2020 5:40:17 PM
Event ID: 4005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: RDS-2019-2.domainname
Description:
The Windows logon process has unexpectedly terminated.
Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" /><EventID Qualifiers="49152">4005</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2020-04-27T21:40:17.722382600Z" /><EventRecordID>97887</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>Application</Channel><Computer>RDS-2019-2.domainname</Computer><Security /></System><EventData><Binary>CA080000</Binary></EventData></Event>This is the winlogon error. (App log - Event ID 4005)
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 4/27/2020 5:40:17 PM
Event ID: 4005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: RDS-2019-2.domainname
Description:
The Windows logon process has unexpectedly terminated.
Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" /><EventID Qualifiers="49152">4005</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2020-04-27T21:40:17.722382600Z" /><EventRecordID>97887</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>Application</Channel><Computer>RDS-2019-2.domainname</Computer><Security /></System><EventData><Binary>CA080000</Binary></EventData></Event>
At the same time as this, in the System log, were the following 2 entries:
Log Name: System
Source: Service Control Manager
Date: 4/27/2020 5:40:17 PM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: RDS-2019-2.domainname
Description:
The Background Intelligent Transfer Service service entered the running state.
Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /><EventID Qualifiers="16384">7036</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime="2020-04-27T21:40:17.112636800Z" /><EventRecordID>45968</EventRecordID><Correlation /><Execution ProcessID="868" ThreadID="36952" /><Channel>System</Channel><Computer>RDS-2019-2.domainname</Computer><Security /></System><EventData><Data Name="param1">Background Intelligent Transfer Service</Data><Data Name="param2">running</Data><Binary>42004900540053002F0034000000</Binary></EventData></Event>Log Name: System
Source: Service Control Manager
Date: 4/27/2020 5:40:17 PM
Event ID: 7040
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: RDS-2019-2.domainname
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /><EventID Qualifiers="16384">7040</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime="2020-04-27T21:40:17.232363900Z" /><EventRecordID>45969</EventRecordID><Correlation /><Execution ProcessID="868" ThreadID="36952" /><Channel>System</Channel><Computer>RDS-2019-2.domainname</Computer><Security UserID="S-1-5-18" /></System><EventData><Data Name="param1">Background Intelligent Transfer Service</Data><Data Name="param2">demand start</Data><Data Name="param3">auto start</Data><Data Name="param4">BITS</Data></EventData></Event>